{"id":"CVE-2026-88386","title":"libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks","summary":"libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-122","CWE-843"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","affected":["enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3"],"published":"2026-09-24","updated":"2026-09-25","sourceUpdated":"2026-09-25T17:17:17.833","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88386","references":[{"url":"https://github.com/libsndfile/libsndfile/issues/1150","label":"cve@mitre.org"},{"url":"https://github.com/mhlavink/libsndfileci/commit/474e4d328b1e6240b93ec6ed14efb7c6a44bee57","label":"cve@mitre.org"},{"url":"https://github.com/libsndfile/libsndfile/issues/1150","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88386.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-88386"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2540836"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88386"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88386"}],"tags":["nvd","cve.org","csaf","vex","red-hat","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-25T16:48:59.681171Z"},"ingestedAt":"2026-09-24T20:51:40.266Z","slug":"CVE-2026-88386","body":"## Overview\n\nlibsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88386.json)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":211069,"id":"CVE-2026-88386","ts":1790356439570,"field":"exploit_available","old":"false","new":"true"},{"seq":210667,"id":"CVE-2026-88386","ts":1790322155779,"field":"cvss","old":null,"new":"5.5"},{"seq":210666,"id":"CVE-2026-88386","ts":1790322155779,"field":"severity","old":"none","new":"medium"}]}