CVE-2022-33065

What it actually does

Signed integer overflows in au_read_header, mat4_open, and mat4_read_header allow out-of-bounds memory access or crashes during parsing of malformed AU and MAT4 audio files.

Why it matters to the business

Applications that process untrusted audio files can crash or behave unexpectedly, disrupting reverse-engineering workflows and requiring emergency patching of deployed packages.

How an attack unfolds

An attacker crafts a malicious AU or MAT4 file containing specially chosen header values that trigger the signed integer overflows; when the vulnerable code opens or analyzes the file, memory corruption or denial of service occurs.

How to fix it

Upgrade radare2 to version 5.9.0+dfsg-1 or later on Debian 13 systems; rebuild any local packages that statically link the vulnerable libsndfile code.

How to confirm the fix worked

Confirm radare2 package version is 5.9.0+dfsg-1 or newer; test parsing of known-malformed test files to verify absence of crashes.

Typical attack path

1. Obtain or generate a crafted AU/MAT4 audio file with malicious header fields
2. Deliver the file to a target system running an affected radare2 package
3. Open or analyze the file using radare2 or dependent tooling
4. Trigger the integer overflow during header parsing
5. Cause crash or undefined behavior

How to detect it

Review application logs and crash reports for segmentation faults or aborts occurring during AU or MAT4 file parsing; correlate with file creation or download events preceding the failure.

What your security team should do

• Prioritize upgrade of radare2 packages to 5.9.0+dfsg-1 within 30 days
• Scan package inventories for any other libsndfile-dependent tools
• Add file-type validation or sandboxing for audio analysis workflows
• Monitor EPSS and exploit availability for changes in risk posture