CVE-2022-31650

What it actually does

Floating-point exception triggered in lsx_aiffstartwrite during AIFF header processing causes the libsox library to terminate abnormally.

Why it matters to the business

Audio processing workflows that rely on SoX become unavailable when handling certain malformed files, leading to operational interruptions and manual intervention.

How an attack unfolds

An attacker prepares a specially crafted AIFF audio file that triggers the floating-point exception on load and then convinces a user or automated process to run SoX against the file, resulting in a crash.

How to fix it

Upgrade to a SoX release that resolves the floating-point handling defect in aiff.c; until then, isolate SoX from untrusted inputs and consider alternative audio tools for high-risk workflows.

How to confirm the fix worked

Test affected SoX binary against a minimal reproducer AIFF file that previously triggered the exception and confirm the process no longer terminates; scan build logs or dependency manifests for the vulnerable 14.4.2 version string.

Typical attack path

1. Craft AIFF file containing values that provoke division-by-zero or invalid float operation in lsx_aiffstartwrite
2. Deliver file via email, web download, or shared storage
3. Victim or script invokes SoX (or any linked application) on the file
4. Library encounters exception and aborts

How to detect it

Review process crash logs, core dumps, or application event records for SoX invocations that end with floating-point exceptions; correlate file-access timestamps with user or script activity on AIFF inputs.

What your security team should do

• Block or sandbox SoX execution against files originating outside trusted sources
• Monitor upstream SoX releases for a corrective patch and schedule deployment
• Replace SoX with maintained alternatives where AIFF handling is required in automated pipelines