CVE-2026-109828

The record

A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages

Related vulnerabilities

• CVE-2026-92950 vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows… CWE-453
• CVE-2026-41330 OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host… CWE-453
• GHSA-9gp8-hjxr-6f34 OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls CWE-453
• CVE-2026-112898 Pillow is a Python imaging library. CWE-457
• CVE-2026-112893 Pillow is a Python imaging library. CWE-457
• CVE-2026-84391 A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through… CWE-457
• CVE-2026-84639 Triggering an error condition in certain MIME bodies would cause uninitialized memory to… CWE-457
• CVE-2026-78935 Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65… CWE-457