---
id: CVE-2026-109828
title: A vulnerability was found in libsndfile up to 1.2.2
summary: >-
  A vulnerability was found in libsndfile up to 1.2.2. This issue affects the
  function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV
  Parsing. Performing a manipulation results in use of uninitialized variable.
  Remot…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
cwe:
  - CWE-453
  - CWE-457
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T19:26:24.643'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109828'
references:
  - url: 'https://github.com/libsndfile/libsndfile/'
    label: cna@vuldb.com
  - url: 'https://github.com/libsndfile/libsndfile/issues/1169'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-109828'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/1002209'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/417466'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/417466/cti'
    label: cna@vuldb.com
tags:
  - nvd
ingestedAt: '2026-10-13T17:38:53.181Z'
---

## Overview

A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.