CVE-2018-13139 describes a stack-based buffer overflow in the libsndfile audio library (version 1.0.28), specifically within the psf_memset function in common.c, which can be triggered by the sndfile-deinterleave executable. This vulnerability affects Debian Linux and libsndfile. It carries a high CVSS score of 8.8, indicating a critical risk due to its network attack vector, low attack complexity, and potential for high impact on confidentiality, integrity, and availability, likely leading to a denial of service or other unspecified consequences. There is currently no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or significant community discussion has been identified.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0.28CPE matchmatch criteria | cpe:2.3:a:libsndfile_project:libsndfile:1.0.28:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
CVE-2018-13139
Jan 12, 2021A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file. The vulnerability can be triggered by the executable sndfile-deinterleave.
Jul 10, 2018libsndfile: stack-based buffer overflow in sndfile-deinterleave utility
Jul 3, 2018