The vulnerability is located in the wavlike_subchunk_parse function of libsndfile, which is used when opening or processing WAV audio files. The function uses an uninitialized local variable, leading to undefined behavior if a specially crafted WAV file is parsed. The CVE description explicitly states that remote exploitation is possible, and public exploit code has been released. While the precise outcome is not guaranteed, the undefined behavior could potentially allow an attacker to influence the application’s execution flow or compromise its integrity. The weakness is classified under CWE‑453 and CWE‑457.

Affected systems include any software that links against libsndfile versions up to and including 1.2.2. Many audio‑processing applications, media players, digital‑audio workstations, and other programs that read or write WAV files rely on this library. Because the issue resides in a core parsing routine, any component that accepts external audio data is potentially vulnerable. The vulnerable versions are those released before the next major minor update, specifically 1.2.0 through 1.2.2, as documented in the project’s issue tracker.

The CVSS score of 5.3 indicates moderate severity, and no EPSS data is available. The vulnerability is not listed in CISA’s KEV catalog, but the existence of public exploit code and the ability to trigger it via a maliciously crafted audio file means that systems exposed to untrusted audio can be attacked. The attacker only needs to supply the crafted file; no additional privileges are required. Until an official patch is released, the risk remains moderate to high for environments that routinely accept external WAV files. The lack of a current fix underscores the importance of applying the next available update or adopting a defensive workaround.