SoX vulnerabilities

🔔 Create alert RSS

Published CVEs affecting SoX products: 1 record(s), with severity, exploitation and fixes.

Sox 1

Exploited only (KEV) →

CVE-2026-111157 Medium · 6.1 CWE-787 Oct 15, 2026

SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().