The vulnerability resides in jarikomppa's Soloud audio library, specifically within the drwav_read_pcm_frames_s16__msadpcm function in dr_wav.h. It permits an out-of-bounds read, causing a memory corruption condition when parsing WAV files. Because the flaw occurs during normal file parsing, an attacker could trigger it by delivering a crafted WAV file, resulting in data leakage or potential exploitation of the application memory. The weakness corresponds to improper bounds checking (CWE-119) and potential buffer under-read (CWE-125).

Versions of Soloud preceding 20200207 are affected. The vulnerability is tied to the jarikomppa:soloud vendor and applies to any system utilizing the Soloud library that has not been upgraded beyond February 7, 2020. No specific subproduct or version list beyond the 20200207 suffix is provided; therefore, any earlier release is considered vulnerable.

The CVSS score is 4.8, indicating a moderate severity. EPSS is reported as less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, reducing confirmed exploitation concern. Attack requires local execution; thus, an attacker must gain local access or influence application input. Exploitation can be performed by supplying a malicious WAV file to the affected library during read operations. Overall, the risk is contingent upon the need for local code execution or an attacker’s ability to place files into the application’s input stream.