{"id":"AZL-109770","summary":"CVE-2026-111157 affecting package sox 14.4.2.0-34","details":"SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().","modified":"2026-10-26T05:31:35Z","published":"2026-10-15T19:17:30Z","upstream":["CVE-2026-111157"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111157"}],"affected":[{"package":{"name":"sox","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/sox"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"14.4.2.0-34"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109770.json"}}],"schema_version":"1.9.0"}