CVE-2026-88386: libsndfile WAV Parser DOS Vulnerability

CVE-2026-88386 Overview

CVE-2026-88386 affects libsndfile 1.2.2, a widely used C library for reading and writing audio files. The vulnerability resides in the psf_binheader_readf() function during parsing of WAV fmt chunks. A crafted WAV file triggers a misaligned memory access when the function casts an unaligned destination address to unsigned int * and performs a 4-byte store. The resulting undefined behavior leads to a denial-of-service condition in applications that process untrusted audio input. The flaw is tracked under [CWE-122: Heap-based Buffer Overflow] in NVD, and exploitation requires a local user to open a malicious file.

Critical Impact
A specially crafted WAV file can crash any application linked against libsndfile 1.2.2, disrupting audio processing pipelines and services that handle user-supplied media.

Affected Products

libsndfile 1.2.2
Applications and services that link against libsndfile 1.2.2 for WAV parsing
Linux distributions shipping the vulnerable release

Discovery Timeline

2026-09-24 - CVE-2026-88386 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-88386

Vulnerability Analysis

The defect sits inside psf_binheader_readf(), the binary header reader that libsndfile uses to parse container metadata. When processing a WAV fmt chunk, the function writes a 4-byte value through a pointer that is not aligned on a 4-byte boundary. On architectures that enforce strict alignment, this produces a bus error and terminates the process. On architectures that tolerate misalignment, the behavior remains undefined per the C standard and can corrupt adjacent state depending on the compiler's assumptions.

The practical outcome is a reliable crash of any process that calls into libsndfile to parse an attacker-supplied WAV file. Audio transcoders, media players, digital audio workstations, voice-processing backends, and automated analysis pipelines are all exposed when they consume untrusted input.

Root Cause

The root cause is an unsafe pointer cast. psf_binheader_readf() casts a char * or byte-level destination into unsigned int * and dereferences it to store a 32-bit integer parsed from the chunk. The code assumes natural alignment that the surrounding buffer layout does not guarantee. When the fmt chunk is crafted so that the destination offset is not a multiple of four, the store triggers undefined behavior.

Attack Vector

Exploitation requires an attacker to deliver a crafted WAV file and have a local user open or process it. The CVSS vector indicates a local attack path with required user interaction and no privileges needed. Confidentiality and integrity are unaffected, while availability is impacted through process termination.

See the upstream GitHub Issue #1150 and the proposed fix commit 474e4d32 for the technical details of the misaligned store and the alignment-safe replacement.

Detection Methods for CVE-2026-88386

Indicators of Compromise

Unexpected SIGBUS or SIGSEGV terminations in processes that call sf_open(), sf_read_*(), or other libsndfile entry points.
Core dumps whose backtrace includes psf_binheader_readf while parsing a WAV fmt chunk.
WAV files with malformed fmt chunk sizes or padding that force non-4-byte-aligned header offsets.

Detection Strategies

Run libsndfile and dependent binaries under UndefinedBehaviorSanitizer (-fsanitize=alignment) in test environments to surface misaligned stores.
Fuzz WAV parsing paths with tools such as AFL++ or libFuzzer, seeded with the reproducer referenced in GitHub Issue #1150.
Correlate audio-service crash telemetry with recently ingested media files to flag suspicious inputs.

Monitoring Recommendations

Alert on repeated crashes of media-processing workloads originating from the same uploaded file hash.
Capture process termination events and command-line arguments from endpoint telemetry for services that handle user-supplied audio.
Track libsndfile package versions across the fleet and raise an alert when 1.2.2 is detected on production hosts.

How to Mitigate CVE-2026-88386

Immediate Actions Required

Inventory all systems and container images that bundle libsndfile 1.2.2 and prioritize upgrade of exposed workloads.
Restrict ingestion of untrusted WAV files to sandboxed workers that can be restarted on crash without affecting the main service.
Validate WAV fmt chunk sizes at the application boundary before passing files to libsndfile.

Patch Information

An upstream fix is tracked in GitHub Issue #1150 with a candidate patch in commit 474e4d32. The fix replaces the unaligned cast with an alignment-safe byte-wise copy. Upgrade to a libsndfile release that incorporates this change once published by the maintainers, or apply the patch to local builds in the interim.

Workarounds

Reject WAV files whose fmt chunk size or layout does not conform to the Microsoft WAVEFORMATEX specification before passing them to libsndfile.
Run audio decoding in a separate low-privilege process with automatic restart to contain denial-of-service impact.
Where feasible, build libsndfile with -fno-strict-aliasing and alignment sanitizers enabled in staging to detect regressions early.

bash

# Configuration example: isolate libsndfile parsing in a restarting systemd unit
# /etc/systemd/system/audio-decoder@.service
[Service]
ExecStart=/usr/local/bin/audio-decoder %i
Restart=on-failure
RestartSec=1
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
MemoryDenyWriteExecute=yes