{"id":"CVE-2026-129264","kind":"vulnerability","aliases":["CVE-2026-129264"],"related":[],"title":"sox_ng: VOC file parser out-of-bounds write allows remote memory corruption","description":"A security vulnerability has been detected in sox_ng up to 14.8.1. Affected by this issue is the function read_samples_voc of the file src/voc.c of the component VOC Decoder. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 0b40408b. A patch should be applied to remediate this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","summary":"sox_ng, a fork of the SoX audio tool, has an out-of-bounds write in its VOC decoder (read_samples_voc in src/voc.c). A crafted VOC audio file can trigger the write remotely, and the exploit has been disclosed publicly.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["audio-processing","other","sox_ng","voc-files"],"not_affected_if":["no-voc-input","sox_ng-not-installed"],"how_to_check":"- Installed sox_ng version at or below `14.8.1`\n- Whether the VOC decoder (src/voc.c) is reached when processing files from untrusted sources","fix":"- sox_ng: apply patch `0b40408b`; the sources give no fixed version number","status":"open","published_at":"2026-11-14T17:16:53+00:00","first_seen_at":"2026-11-14T17:31:24+00:00","triaged_at":"2026-11-14T17:31:51+00:00","updated_at":"2026-11-14T17:31:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-14T17:31:51Z","model":"claude-haiku-5-5","output":{"fix":"- sox_ng: apply patch `0b40408b`; the sources give no fixed version number","reach":"internet","title":"sox_ng: VOC file parser out-of-bounds write allows remote memory corruption","impact":"high","summary":"sox_ng, a fork of the SoX audio tool, has an out-of-bounds write in its VOC decoder (read_samples_voc in src/voc.c). A crafted VOC audio file can trigger the write remotely, and the exploit has been disclosed publicly.","audience":"developers","category":"other","nicknames":[],"who_cares":["sox_ng","audio-processing","voc-files"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker corrupts memory and may run code on the processing machine.","analyst_note":"unknown","how_to_check":"- Installed sox_ng version at or below `14.8.1`\n- Whether the VOC decoder (src/voc.c) is reached when processing files from untrusted sources","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["sox_ng-not-installed","no-voc-input"],"who_is_affected":"Any system that runs sox_ng up to 14.8.1 to decode VOC audio, especially on files that come from outside the organisation. Systems that never process VOC files or that do not run sox_ng can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001143,"input_tokens":4615,"output_tokens":1362,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129264':17A,20A '-2026':16A,19A '0b40408b':134C '14.8.1':83C 'affect':84C,163C 'allow':11A 'appli':139C 'attack':113C 'audio':22B,37B,58B 'audio-process':21B 'bound':9A,44B,110C 'compon':100C 'contact':147C 'corrupt':14A 'craft':56B 'cve':15A,18A 'decod':49B,102C 'detect':77C 'disclos':70B,122C 'earli':148C 'execut':116C 'exploit':67B,119C 'file':4A,29B,59B,96C 'fix':159C 'fork':33B 'function':90C 'issu':87C,143C 'lead':105C 'manipul':104C 'manner':154C 'may':125C 'memori':13A 'name':129C 'ng':2A,26B,31B,80C 'out-of-bound':6A,41B,107C 'parser':5A 'patch':132C,136C 'process':23B 'product':164C 'profession':153C 'public':71B,123C 'quick':156C 'read':50B,91C 'releas':157C 'remedi':141C 'remot':12A,64B,117C 'respond':149C 'sampl':51B,92C 'secur':73C 'sox':1A,25B,30B,36B,79C 'src/voc.c':54B,97C 'tool':38B 'trigger':61B 'use':127C 'vendor':145C 'version':160C 'voc':3A,28B,48B,52B,57B,93C,101C 'voc-fil':27B 'vulner':74C 'write':10A,45B,63B,111C","nicknames":[],"mitigations":[],"who_affected":"Any system that runs sox_ng up to 14.8.1 to decode VOC audio, especially on files that come from outside the organisation. Systems that never process VOC files or that do not run sox_ng can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["audioprocessing","medium","other","soxng","vocfiles"],"campaign_type":null,"search_a":"'-129264':17A,20A '-2026':16A,19A 'allow':11A 'bound':9A 'corrupt':14A 'cve':15A,18A 'file':4A 'memori':13A 'ng':2A 'out-of-bound':6A 'parser':5A 'remot':12A 'sox':1A 'voc':3A 'write':10A","search_b":"'audio':22B,37B,58B 'audio-process':21B 'bound':44B 'craft':56B 'decod':49B 'disclos':70B 'exploit':67B 'file':29B,59B 'fork':33B 'ng':26B,31B 'out-of-bound':41B 'process':23B 'public':71B 'read':50B 'remot':64B 'sampl':51B 'sox':25B,30B,36B 'src/voc.c':54B 'tool':38B 'trigger':61B 'voc':28B,48B,52B,57B 'voc-fil':27B 'write':45B,63B","search_c":"'0b40408b':134C '14.8.1':83C 'affect':84C,163C 'appli':139C 'attack':113C 'bound':110C 'compon':100C 'contact':147C 'decod':102C 'detect':77C 'disclos':122C 'earli':148C 'execut':116C 'exploit':119C 'file':96C 'fix':159C 'function':90C 'issu':87C,143C 'lead':105C 'manipul':104C 'manner':154C 'may':125C 'name':129C 'ng':80C 'out-of-bound':107C 'patch':132C,136C 'product':164C 'profession':153C 'public':123C 'quick':156C 'read':91C 'releas':157C 'remedi':141C 'remot':117C 'respond':149C 'sampl':92C 'secur':73C 'sox':79C 'src/voc.c':97C 'use':127C 'vendor':145C 'version':160C 'voc':93C,101C 'vulner':74C 'write':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T17:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129264","severity":null,"published_at":"2026-11-14T17:16:53+00:00","modified_at":"2026-11-14T17:16:53+00:00","first_seen_at":"2026-11-14T17:31:24+00:00","fetched_at":"2026-11-14T17:31:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}