SoX Sox vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting SoX Sox: 1 record(s), with affected versions and fixes.

CVE-2026-111157 Medium · 6.1 CWE-787 Oct 15, 2026

SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().