# CVE-2026-88372: libsndfile integer overflow in MAT4 file parsing

Source: https://junglewise.ai/threats/cve-2026-88372-libsndfile-1-2-2-contains-an-integer-overflow-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88372 · Severity: high · CVSS 7.5 · Published 2026-09-24

libsndfile is an audio file library used by media players and recording applications to read sound files in various formats. A flaw in how it parses MATLAB v4 audio files can cause the application to crash or potentially read and write memory outside allocated bounds when opening a malicious file. An attacker can exploit this by distributing a crafted MAT4 file that triggers undefined behavior.

Technologies: [Libsndfile](https://junglewise.ai/threats/technologies/libsndfile-libsndfile). Vendors: [Libsndfile](https://junglewise.ai/threats/vendors/libsndfile).

## Quick answers

**Is CVE-2026-88372 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88372 being exploited in the wild.

**How severe is CVE-2026-88372?** High severity, with a CVSS score of 7.5, published 24 September 2026.

**Which products and versions are affected?** Libsndfile 1.2.2.

**Is there a fix for CVE-2026-88372?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88372 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88372?** Check whether you run Libsndfile at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in mat4_read_header() when computing buffer sizes from attacker-controlled rows, cols, channels, and frames fields in MAT4 file headers. The function multiplies these 32-bit fields together without overflow checks, leading to signed 64-bit integer overflow in sf_count_t arithmetic. This can cause denial of service via SIGILL trap (on sanitized builds) or out-of-bounds memory access via corrupted length calculations during subsequent file parsing.

## Affected products

- libsndfile libsndfile 1.2.2

## Timeline

- 2026-08-05: disclosed: Issue reported on GitHub
- 2026-09-24: advisory: CVE-2026-88372 published

## References

- [https://github.com/libsndfile/libsndfile/issues/1151](https://github.com/libsndfile/libsndfile/issues/1151)

## Related threats

- [libsndfile uninitialized variable in WAV parsing](https://junglewise.ai/threats/cve-2026-109828-a-vulnerability-was-found-in-libsndfile-up-to-1-2-2-this-issue)
- [libsndfile misaligned memory access in WAV fmt chunk parsing](https://junglewise.ai/threats/cve-2026-88386-libsndfile-1-2-2-contains-a-misaligned-memory-access-issue-in-psf)