CVE-2009-4835: The (1) htk_read_header, (2) alaw_init, (3) ulaw_init, (4) pcm_init, (5) float32_init, and (6) sds_read_header functions in libsndfile 1.0.20 allow…

PriorityP410medium4.3CVSS 2.0

AVNACMAuNCNINAP

EPSS

1.44%

69.9th percentile

The (1) htk_read_header, (2) alaw_init, (3) ulaw_init, (4) pcm_init, (5) float32_init, and (6) sds_read_header functions in libsndfile 1.0.20 allow context-dependent attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted audio file.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	libsndfile	< libsndfile 1.0.21-3 (bookworm)	libsndfile 1.0.21-3 (bookworm)
libsndfile_project	libsndfile	>= 0 < 1.0.21-3	1.0.21-3
libsndfile_project	libsndfile	>= 0 < 1.0.21-3	1.0.21-3
libsndfile_project	libsndfile	>= 0 < 1.0.21-3	1.0.21-3
libsndfile_project	libsndfile	>= 0 < 1.0.21-3	1.0.21-3
mega-nerd	libsndfile	—	—

CVSS provenance

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

osv4.3MEDIUM

vendor_debian4.3LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.