SoX up to version 14.4.2 contains a heap out‑of‑bounds write in the function lsx_ms_adpcm_block_expand_i(), triggered by a crafted MS ADPCM WAV file with an odd samplesPerBlock value. The write allows an attacker to place a partially controlled 16‑bit sample beyond the heap buffer allocated by wav_ms_adpcm_fmt(), potentially corrupting memory and leading to arbitrary code execution or denial of service if the vector is exercised by a user or application that processes the file.

SoX version 14.4.2 and all earlier releases are affected, and any application or library that uses libsox to read MS ADPCM WAV files is also vulnerable. The issue is specific to the MS ADPCM implementation and does not affect other WAV formats or newer SoX releases that have removed or patched the overflow.

The CVSS score of 6.9 indicates medium severity; no EPSS value is available, so the likelihood of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by supplying a malicious WAV file to any instance of sox or libsox running with privileges sufficient to write to memory, so the risk is highest when the software runs under administrative or system service accounts. Due to the lack of an official patch in the public release, immediate mitigation steps are required to reduce exposure.