CVE-2021-4156

7.1 HIGH
Published: March 23, 2022 Modified: December 11, 2025

Description

An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2027690
Source: secalert@redhat.com
Exploit Issue Tracking Third Party Advisory
https://github.com/libsndfile/libsndfile/issues/731
Source: secalert@redhat.com
Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/06/msg00020.html
Source: secalert@redhat.com
Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00036.html
Source: secalert@redhat.com
Mailing List Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2027690
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Issue Tracking Third Party Advisory
https://github.com/libsndfile/libsndfile/issues/731
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Issue Tracking Third Party Advisory
https://github.com/libsndfile/libsndfile/pull/732/commits/4c30646abf7834e406f7e2429c70bc254e18beab
Source: af854a3a-2127-422b-91ae-364da2661108
Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/06/msg00020.html
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00036.html
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202309-11
Source: af854a3a-2127-422b-91ae-364da2661108

13 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.1 / 10.0
EPSS (Exploit Probability)
0.1%
29th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

Affected Vendors

debian libsndfile_project