A vulnerability was found in libsndfile up to 1.2.2. (CVE-2026-109828)

CVE-2026-109828 is a vulnerability in libsndfile versions up to 1.2.2, located in the wavlike_subchunk_parse function within src/wavlike.c. The flaw arises from the use of an uninitialized variable during WAV file parsing. This can be manipulated remotely, potentially leading to unintended behavior. The vulnerability has a CVSS 3.1 base score of 4.3, indicating low severity. Although an exploit has been made public, no official patch or vendor response has been provided as of the publication date.

The vulnerability allows remote attackers to trigger the use of an uninitialized variable in the WAV parsing component of libsndfile, which may lead to limited information disclosure or other low-impact consequences. There is no indication of integrity or availability impact. The CVSS vector indicates no privileges required and low attack complexity, but user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider restricting exposure to untrusted WAV files or applying application-level mitigations if feasible.