CVE-2026-37555

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-37555
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-37555.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-37555
Downstream
Related
Published
2026-04-29T00:00:00Z
Modified
2026-08-12T16:23:54Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37555.json"
}
References

Affected packages

Git / github.com/libsndfile/libsndfile

Affected ranges

Type
GIT
Repo
https://github.com/libsndfile/libsndfile
Events
Introduced
72f6af15e8f85157bd622ed45b979025828b7001
Fixed
9a829113c88a51e57c1e46473e90609e4b7df151
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:libsndfile_project:libsndfile:1.2.2:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.2.2"
        },
        {
            "last_affected": "1.2.2"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-37555.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "158301802949045650805615312711331958203",
            "length": 2114
        },
        "id": "CVE-2026-37555-035d7453",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151",
        "target": {
            "file": "src/ima_adpcm.c",
            "function": "ima_reader_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "5598550403622091314721391869535982066",
                "70664204037686353697131958862979994765",
                "105115933207297962481181414997374448411",
                "240091315527656350623368657685235946015",
                "196116648171470982375483881254452847716",
                "65714930739034776716907527057539936184",
                "249949236106998382268526516595076153219",
                "100135922117835201270629341136249900088",
                "307293857777353333195989261942351153882",
                "249474273958811348909207250940668651602",
                "82066433527043501977053399490207294598",
                "242382773205234862024198474376857315588"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-37555-e868f8e8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151",
        "target": {
            "file": "src/ima_adpcm.c"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T16:23:54Z"