{"id":"CVE-2026-37555","details":"An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.","modified":"2026-08-12T16:23:54.980324Z","published":"2026-04-29T00:00:00Z","related":["ALSA-2026:19559","ALSA-2026:19560","ALSA-2026:19610","SUSE-SU-2026:1968-1","SUSE-SU-2026:1969-1","SUSE-SU-2026:21826-1","openSUSE-SU-2026:10730-1","openSUSE-SU-2026:20787-1"],"database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37555.json"},"references":[{"type":"WEB","url":"https://gist.github.com/sgInnora/a5f5c19e4bf6f4fb74fab7b0ef2bfcc1"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37555.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19559"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19560"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19610"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23221"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23222"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23223"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25092"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25197"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25198"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25227"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30078"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30087"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-37555"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37555.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37555"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463856"},{"type":"REPORT","url":"https://github.com/libsndfile/libsndfile/issues/833"},{"type":"FIX","url":"https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libsndfile/libsndfile","events":[{"introduced":"72f6af15e8f85157bd622ed45b979025828b7001"},{"fixed":"9a829113c88a51e57c1e46473e90609e4b7df151"}],"database_specific":{"cpe":"cpe:2.3:a:libsndfile_project:libsndfile:1.2.2:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.2.2"},{"last_affected":"1.2.2"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.2.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-37555.json","vanir_signatures_modified":"2026-08-12T16:23:54Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"158301802949045650805615312711331958203","length":2114},"id":"CVE-2026-37555-035d7453","signature_type":"Function","signature_version":"v1","source":"https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151","target":{"file":"src/ima_adpcm.c","function":"ima_reader_init"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151","target":{"file":"src/ima_adpcm.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["5598550403622091314721391869535982066","70664204037686353697131958862979994765","105115933207297962481181414997374448411","240091315527656350623368657685235946015","196116648171470982375483881254452847716","65714930739034776716907527057539936184","249949236106998382268526516595076153219","100135922117835201270629341136249900088","307293857777353333195989261942351153882","249474273958811348909207250940668651602","82066433527043501977053399490207294598","242382773205234862024198474376857315588"]},"id":"CVE-2026-37555-e868f8e8"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}