CVE-2026-129264 · Other
NO FIX YET · SEE WHAT TO DO
sox_ng, a fork of the SoX audio tool, has an out-of-bounds write in its VOC decoder (read_samples_voc in src/voc.c). A crafted VOC audio file can trigger the write remotely, and the exploit has been disclosed publicly.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any system that runs sox_ng up to 14.8.1 to decode VOC audio, especially on files that come from outside the organisation. Systems that never process VOC files or that do not run sox_ng can skip it.
Not affected if no-voc-input, sox_ng-not-installed
Who cares audio-processing, sox_ng, voc-files
14.8.10b40408b; the sources give no fixed version numberA security vulnerability has been detected in sox_ng up to 14.8.1. Affected by this issue is the function read_samples_voc of the file src/voc.c of the component VOC Decoder. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 0b40408b. A patch should be applied to remediate this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.