CVE-2014-9496

What it actually does

Out-of-bounds read in sd2_parse_rsrc_fork triggered by crafted map offset or rsrc marker values, resulting in denial of service.

Why it matters to the business

Applications processing untrusted audio files may crash, causing service interruptions; the packages are widely used in containerized environments so exposure scales with image adoption.

How an attack unfolds

An attacker supplies a malicious SD2 audio file containing invalid map offset or rsrc marker values; when an affected application parses the file using the vulnerable libsndfile code, the out-of-bounds read occurs and the process terminates.

How to fix it

Upgrade the affected packages to the versions containing the fix: keycloak-fips, keycloak-fips-bitnami-compat, keycloak-fips-policy-140-2, and keycloak-fips-policy-140-3 all fixed in 25.0.0-r0.

How to confirm the fix worked

Confirm the running package versions match or exceed the listed fixed releases and verify that SD2 parsing no longer triggers crashes on known malformed test files.

Typical attack path

1. Obtain or craft an SD2 file with invalid map offset or rsrc marker
2. Deliver the file to a target application that links against the vulnerable library
3. Trigger file parsing through normal application workflows
4. Observe process crash or denial of service

How to detect it

Review application or container logs for unexpected process terminations or segmentation faults while handling audio files; no specific post-exploitation artifacts are known for this older memory-safety issue.

What your security team should do

• Prioritize patching the listed Chainguard packages to 25.0.0-r0 or later within normal maintenance windows
• Scan container images for the vulnerable package versions and rebuild any that are affected
• Add the fixed versions to allowed image policies and CI gates