A misaligned memory access bug exists in libsndfile 1.2.2 within the function psf_binheader_readf when parsing WAV fmt chunks. When an attacker supplies a specially crafted WAV file, the function casts an unaligned destination address to an unsigned int pointer and performs a 4‑byte store, leading to undefined behaviour and a crash of the consuming application, which manifests as a denial of service.

The vulnerability affects libsndfile version 1.2.2. No specific vendors or products are listed in the advisory; the library is a widely used component for reading audio files.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to provide a malicious WAV file to the application that uses libsndfile, making the attack dependent on the ability to supply files to the target. Because the flaw is confined to the file‑parsing routine, no additional privileges are required beyond the ability to introduce the file.