CVE-2026-111157

A flaw was found in SoX. An attacker can exploit this vulnerability by tricking a user or automated system into opening a specially crafted WAV audio file. During audio decoding, an invalid block sample value causes a heap-based out-of-bounds write, leading to an application crash, resulting in a Denial of Service (DoS), or potential memory corruption.

Red Hat has evaluated this vulnerability as having a Moderate impact because successful exploitation requires user interaction to process an untrusted audio file, restricting the blast radius to the executing process. In Red Hat Enterprise Linux, SoX operates as a command-line utility or shared library rather than a persistently listening network service. Consequently, the primary outcome of exploitation is an application crash or process termination, limiting systemic risk without additional vulnerability chaining.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.