The vulnerability resides in Soloud's WAV file handler. The loadflac function reads FLAC data into a fixed‑size heap buffer without proper bounds checking, creating a heap‑based buffer overflow that corresponds to CWE-119 and CWE-122. This flaw can corrupt memory, potentially leading to abrupt process termination or, under certain conditions, the execution of arbitrary code if the attacker can manipulate the input further.

All installations of the jarikomppa Soloud library up to the 20200207 release are vulnerable. The flaw exists in the source file soloud_wav.cpp and has been confirmed in releases up to and including that date. Specific version ranges beyond 20200207 are not provided, but the issue is limited to code present in that and earlier releases.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is below 1%, suggesting a low likelihood of exploitation at present. The flaw requires local access to a process that processes FLAC audio data and is not listed in the CISA KEV catalog. No official patch has been published yet, but the issue is publicly disclosed on GitHub and other channels, meaning an attacker can craft input to trigger the overflow if the vulnerable function is invoked.