CVE-2023-49994

What it actually does

Floating point exception triggered in PeaksToHarmspect at wavegen.c causes the espeak-ng process to terminate abnormally.

Why it matters to the business

Text-to-speech or speech synthesis operations using affected espeak-ng versions can be interrupted by crashes, disrupting accessibility features, automated narration, or voice output pipelines.

How an attack unfolds

An attacker supplies crafted audio or speech synthesis input that reaches the PeaksToHarmspect function in wavegen.c, triggering a floating point exception that crashes the process.

How to fix it

Upgrade espeak-ng to a version that resolves the floating point exception in PeaksToHarmspect; until a fix is released, restrict untrusted input to the library or wrap calls in a crash-resilient service.

How to confirm the fix worked

Reproduce the crash with the original proof-of-concept input after applying updates; confirm the process no longer terminates when the same input is processed.

Typical attack path

1. Identify an application or script that invokes espeak-ng for speech synthesis
2. Craft input that exercises the vulnerable code path in wavegen.c
3. Supply the input via command line, API call, or file to espeak-ng
4. Observe process termination due to the floating point exception

How to detect it

Search process and system logs for segmentation or floating point exception signals originating from espeak-ng or the wavegen module; correlate with recent synthesis requests.

• espeak-ng process terminated with SIGFPE
• wavegen.c:PeaksToHarmspect

What your security team should do

• Prioritize upgrade of espeak-ng once a fixed release is available
• Sandbox or isolate espeak-ng invocations that accept external input
• Monitor application logs for abrupt terminations during speech synthesis tasks