In libsndfile version 1.2.2, the IMA ADPCM codec's WAV code path improperly handles multiplication of samplesperblock and blocks as 32-bit integers. When the product exceeds the maximum 32-bit integer value (INT_MAX), an integer overflow occurs before assigning the result to sf.frames, which is a 64-bit integer type. This overflow leads to an incorrect frame count, potentially causing a heap buffer overflow or denial of service. The values samplesperblock and blocks are derived from the WAV file header and can be controlled by an attacker. This vulnerability was discovered after an incomplete fix addressing a related issue (CVE-2022-33065) in the AIFF code path.

An attacker can craft a malicious WAV file with specially crafted header values to trigger an integer overflow in the multiplication of samplesperblock and blocks. This results in an incorrect frame count that can cause a heap buffer overflow or denial of service when the file is processed by libsndfile 1.2.2. This may lead to application crashes or potential memory corruption. There is no information indicating known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or malicious WAV files with libsndfile 1.2.2. Monitor vendor channels for updates addressing this integer overflow vulnerability.