The vulnerability is located in the wavlike_subchunk_parse function of libsndfile, a core routine used when opening or processing WAV files. Inside this function, an uninitialized local variable is used during parsing. The resulting undefined behavior can be exploited with a specially crafted WAV file to influence the application’s execution flow or cause memory corruption. According to the CVE description, remote exploitation is possible and public exploit code has been released. The weakness is classified under CWE‑908, representing an uninitialized variable, improper memory handling, and uncontrolled memory allocation, respectively.

Affected systems include any software that links against libsndfile versions up to and including 1.2.2. Many audio‑processing applications, media players, digital‑audio workstations, and other programs that read or write WAV files rely on this library. Because the issue resides in a core parsing routine, any component that accepts external audio data is potentially vulnerable. The vulnerable versions are those released before the next major minor update, specifically 1.2.0 through 1.2.2, as documented in the project’s issue tracker.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is below 1%, reflecting a low but nonzero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Public exploit code is available, and an attacker only needs to supply a maliciously crafted WAV file to trigger the effect; no elevated privileges or additional access are required. Until an official patch is released, the risk remains moderate to high for environments that routinely accept external WAV files, especially if those files come from untrusted sources.