An integer overflow bug has been identified in libsndfile 1.2.2’s IMA ADPCM codec. In the WAV handling path the product of an integer field "samplesperblock" and another field "blocks" is calculated with a 32‑bit multiplication. When the 50000*50000 product (2.5 billion) exceeds the 32‑bit signed range, the value overflows to a negative number before being assigned to a 64‑bit frame counter. This incorrect frame count can lead to a heap buffer overflow or a denial‑of‑service condition. The overflow originates from data supplied in the WAV file header, which an attacker can control, so the vulnerability is exploitable via a crafted audio file.

Any installation of libsndfile 1.2.2 that employs the IMA ADPCM codec is affected. The gap was left unpatched after an incomplete fix for a prior CVE. All systems processing user‑supplied WAV files with this library version are at risk.

The vulnerability admits a local or remote attacker who can supply a malicious WAV header to trigger the overflow. Because the library allocates memory based on the corrupted frame count, the condition can lead to arbitrary code execution or a crash, resulting in denial of service. No EPSS score is available and the issue is not listed in CISA’s KEV catalog, but the classic integer overflow bug coupled with an unbounded heap allocation clearly signals a high severity risk.