In libsndfile 1.2.2, the WAV code path in the IMA ADPCM codec performs a 32-bit multiplication of samplesperblock and blocks, both integers derived from the WAV file header. When the product exceeds INT_MAX, the multiplication overflows before being assigned to sf.frames, a 64-bit variable, resulting in an incorrect frame count. For example, samplesperblock=50000 and blocks=50000 produce a product of 2,500,000,000, which overflows to a negative value in 32-bit arithmetic. This incorrect frame count can lead to a heap buffer overflow or denial of service. The AIFF code path was fixed with a cast to 64-bit, but the WAV path and close path remain vulnerable. This vulnerability is a consequence of an incomplete fix for CVE-2022-33065.

An attacker can craft a malicious WAV file with specially crafted header values to trigger a 32-bit integer overflow in the multiplication of samplesperblock and blocks. This causes an incorrect frame count leading to heap buffer overflow or denial of service in applications using libsndfile 1.2.2. The vulnerability does not affect confidentiality or integrity directly but impacts availability and memory safety, potentially causing crashes or exploitation through memory corruption.

Red Hat has released security updates for libsndfile version 1.2.2 in Red Hat Enterprise Linux 10.0 Extended Update Support that address this integer overflow vulnerability. Users should apply the official Red Hat security updates as detailed in the advisory (RHSA-2026:25092) to remediate this issue. Patch status is confirmed by the vendor advisory. No alternative mitigations are specified; applying the vendor-provided update is the recommended action.