CVE-2026-88386

What it actually does

libsndfile 1.2.2 performs an unaligned 4-byte store in psf_binheader_readf() when parsing a WAV fmt chunk: an unaligned destination is cast to unsigned int * and written. That is undefined behavior and typically aborts or crashes the hosting process (SIGBUS/SIGSEGV or equivalent), causing a local denial of service. Confidentiality and integrity are not indicated; impact is availability only. Attack vector is local with required user interaction (opening or otherwise parsing a crafted WAV).

Why it matters to the business

Any product that uses libsndfile 1.2.2 to ingest WAV files—desktop audio tools, media converters, preview/transcode pipelines, or upload handlers—can be crashed by a malicious file, interrupting processing until the process is restarted. There is no CISA KEV listing, no reported ransomware use, and exploit maturity is none as of 16 days after publication, so mass exploitation is not indicated. Operational risk is highest where untrusted user-supplied audio is parsed automatically in a shared or long-running worker.

How an attack unfolds

An attacker supplies a specially crafted WAV whose fmt chunk triggers the unaligned store in psf_binheader_readf(). The victim (or an automated pipeline) opens or parses that file with an application linked to the vulnerable libsndfile. The parser hits undefined behavior and the process crashes, denying audio processing for that instance. No remote unauthenticated network exploit, credential theft, or code execution is described; success depends on getting the target to parse the file.

How to fix it

Upgrade libsndfile to a vendor-fixed release as soon as one is published for this issue; rebuild and redeploy all statically linked binaries. Until then, do not parse untrusted WAV files with 1.2.2; isolate or sandbox audio parsers, disable automatic preview/transcode of WAV, and prefer formats or libraries not affected. Restrict who can submit audio to processing services. Confirm your distribution or upstream advisory for the exact patched version, as no fixed-version mapping was provided with this record.

How to confirm the fix worked

Inventory packages, containers, and statically linked binaries for libsndfile 1.2.2 (pkg config, shared-library soname, SBOM, or strings on the binary). After upgrade, confirm the library version in runtime images and that WAV ingest still succeeds on known-good files. Do not use attacker-crafted files to prove the bug; rely on version checks, vendor patches, and crash-free processing of legitimate WAV corpus. Architectures that trap unaligned access (some ARM/RISC-V) are useful canaries in test environments using only benign samples plus version verification.

Typical attack path

1. Obtain or generate a WAV whose fmt chunk induces the unaligned store in psf_binheader_readf()
2. Deliver the file via download, email, shared storage, or an upload/transcode API that uses libsndfile
3. Wait for a user or automated worker to open or parse the file with a vulnerable build
4. Observe process crash or worker restart, repeating as needed to disrupt availability

How to detect it

This flaw causes a crash, not persistence or network callbacks, and no named threat actors or KEV activity are associated. Hunt for unexpected exits of processes that load libsndfile when handling WAV, especially SIGBUS or SIGSEGV with psf_binheader_readf or WAV fmt-chunk parsing on the stack. Review application and kernel logs around audio upload, preview, or conversion jobs; core dumps or crashpad/breakpad reports naming libsndfile; and a spike of failed transcode jobs on WAV inputs. Absence of those artifacts does not prove non-exploitation of a one-shot crash. Correlate with user-supplied WAV files received shortly before the crash.

• psf_binheader_readf
• libsndfile
• SIGBUS
• WAV fmt
• sf_open

What your security team should do

• Prioritize inventory of libsndfile 1.2.2 in apps, containers, and statically linked media tools
• Patch or rebuild as soon as an upstream fix is available; track vendor advisories because no fixed version is listed here
• Quarantine untrusted WAV ingest and disable automatic parse/preview until patched
• Sandbox or crash-budget audio workers so a single file cannot take down a shared service
• Watch for process crashes in audio pipelines; this is not KEV and has no known in-the-wild exploitation, so treat as standard patch hygiene rather than emergency ransomware response