CVE-2026-109828

A flaw was found in libsndfile. A remote attacker could exploit this vulnerability by enticing a user or application to process a specially crafted WAV audio file, triggering the use of an uninitialized variable during subchunk parsing. This issue may allow an attacker to read uninitialized memory contents, resulting in unauthorized information disclosure.

This vulnerability is rated as having Moderate severity because successful exploitation requires user interaction to process an untrusted audio file, with the impact limited to information disclosure. In typical Red Hat environments, the affected library is utilized by multimedia applications and utilities to handle audio formats, meaning the issue cannot be triggered autonomously across the network without an application actively reading a specially crafted WAV container. Because the flaw involves reading uninitialized memory rather than arbitrary code execution or persistent system compromise, confidentiality is only partially affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.