CVE-2023-32627

What it actually does

A floating point exception in the read_samples function at voc.c:334 triggers a crash when processing malformed VOC audio files, resulting in denial of service.

Why it matters to the business

Organizations relying on SoX for audio file conversion or processing may experience workflow interruptions or service outages when untrusted VOC files are handled; low EPSS and absence from KEV indicate limited real-world exploitation pressure, though downstream dependents in Fedora and RHEL ecosystems increase exposure surface.

How an attack unfolds

An attacker crafts a specially malformed VOC file that reaches the vulnerable read_samples code path; when a local user or automated process invokes SoX on the file, the floating point exception aborts execution, denying service without requiring elevated privileges.

How to fix it

Upgrade SoX to a version containing a fix for the voc.c floating-point exception; where no fixed release is yet published, replace SoX usage with alternative audio tools or wrap invocations with input sanitization and sandboxing to prevent untrusted file processing.

How to confirm the fix worked

Confirm the presence of the vulnerable read_samples function in voc.c and test with known-malformed VOC samples; after upgrade, re-run the same test files to verify the exception no longer occurs and monitor process stability.

Typical attack path

1. Attacker generates a crafted VOC file containing input that triggers improper floating-point handling
2. Victim or automated system executes SoX locally against the file
3. read_samples function at voc.c:334 encounters the exception and terminates the process
4. Service or batch job using SoX becomes unavailable until restart

How to detect it

Search system and application logs for SoX process crashes accompanied by floating-point exception signals while processing .voc files; review audit logs for invocations of the sox binary against files originating from untrusted sources.

• sox.*floating point exception
• voc.c:334
• read_samples.*SIGFPE

What your security team should do

• Prioritize patching SoX on all Fedora, RHEL, and direct installations within 30 days given the 1185-day disclosure window
• Inventory all scripts and services that invoke SoX on user-supplied audio files
• Implement file-type whitelisting or sandbox execution for any remaining SoX usage until patches are applied
• Update vulnerability management dashboards to reflect the low EPSS score and non-KEV status while still tracking remediation