CVE-2026-4009

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4009", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-11T19:01:26.939Z", "datePublished": "2026-03-12T07:02:08.275Z", "dateUpdated": "2026-03-12T14:05:35.620Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-12T07:02:08.275Z"}, "title": "jarikomppa soloud WAV File dr_wav.h drwav_read_pcm_frames_s16__msadpcm out-of-bounds", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "jarikomppa", "product": "soloud", "versions": [{"version": "20200207", "status": "affected"}, {"version": "20200207", "status": "unaffected"}], "modules": ["WAV File Parser"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in jarikomppa soloud up to 20200207. Impacted is the function drwav_read_pcm_frames_s16__msadpcm in the library src/audiosource/wav/dr_wav.h of the component WAV File Parser. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. Upgrading to version 20200207 is recommended to address this issue. It is recommended to upgrade the affected component. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-03-11T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-11T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-11T20:06:48.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Oneafter (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.350532", "name": "VDB-350532 | jarikomppa soloud WAV File dr_wav.h drwav_read_pcm_frames_s16__msadpcm out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.350532", "name": "VDB-350532 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.769766", "name": "Submit #769766 | jarikomppa soloud SoLoud 20200207 and master-branch Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/jarikomppa/soloud/issues/401", "tags": ["issue-tracking"]}, {"url": "https://github.com/oneafter/0209/blob/main/so3/repro", "tags": ["exploit"]}, {"url": "https://github.com/jarikomppa/soloud/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T14:05:24.901748Z", "id": "CVE-2026-4009", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:05:35.620Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4009", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T14:05:24.901748Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:05:32.096Z"}}], "cna": {"title": "jarikomppa soloud WAV File dr_wav.h drwav_read_pcm_frames_s16__msadpcm out-of-bounds", "credits": [{"lang": "en", "type": "reporter", "value": "Oneafter (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "jarikomppa", "modules": ["WAV File Parser"], "product": "soloud", "versions": [{"status": "affected", "version": "20200207"}, {"status": "unaffected", "version": "20200207"}]}], "timeline": [{"lang": "en", "time": "2026-03-11T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-11T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-11T20:06:48.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.350532", "name": "VDB-350532 | jarikomppa soloud WAV File dr_wav.h drwav_read_pcm_frames_s16__msadpcm out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.350532", "name": "VDB-350532 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.769766", "name": "Submit #769766 | jarikomppa soloud SoLoud 20200207 and master-branch Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/jarikomppa/soloud/issues/401", "tags": ["issue-tracking"]}, {"url": "https://github.com/oneafter/0209/blob/main/so3/repro", "tags": ["exploit"]}, {"url": "https://github.com/jarikomppa/soloud/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in jarikomppa soloud up to 20200207. Impacted is the function drwav_read_pcm_frames_s16__msadpcm in the library src/audiosource/wav/dr_wav.h of the component WAV File Parser. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. Upgrading to version 20200207 is recommended to address this issue. It is recommended to upgrade the affected component. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-12T07:02:08.275Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4009", "state": "PUBLISHED", "dateUpdated": "2026-03-12T14:05:35.620Z", "dateReserved": "2026-03-11T19:01:26.939Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-12T07:02:08.275Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["WAV File Parser"], "product": "soloud", "vendor": "jarikomppa", "versions": [{"status": "affected", "version": "20200207"}, {"status": "unaffected", "version": "20200207"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in jarikomppa soloud up to 20200207. Impacted is the function drwav_read_pcm_frames_s16__msadpcm in the library src/audiosource/wav/dr_wav.h of the component WAV File Parser. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. Upgrading to version 20200207 is recommended to address this issue. It is recommended to upgrade the affected component. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en jarikomppa soloud hasta 20200207. Afectada est\u00e1 la funci\u00f3n drwav_read_pcm_frames_s16__msadpcm en la biblioteca src/audiosource/wav/dr_wav.h del componente WAV File Parser. La manipulaci\u00f3n conduce a una lectura fuera de l\u00edmites. El ataque necesita ser realizado localmente. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. Se recomienda actualizar a la versi\u00f3n 20200207 para abordar este problema. Se recomienda actualizar el componente afectado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de problema, pero a\u00fan no ha respondido."}], "id": "CVE-2026-4009", "lastModified": "2026-06-17T10:55:50.927", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 1.7, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4009", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T14:05:24.901748Z", "version": "2.0.3"}}]}, "published": "2026-03-12T08:16:11.150", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/jarikomppa/soloud/"}, {"source": "cna@vuldb.com", "url": "https://github.com/jarikomppa/soloud/issues/401"}, {"source": "cna@vuldb.com", "url": "https://github.com/oneafter/0209/blob/main/so3/repro"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.350532"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.350532"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.769766"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-125"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20200207"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "20200207"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "soloud", "source": "cna", "vendor": "jarikomppa"}, "product": "soloud", "vendor": "jarikomppa"}], "analysis": {"en": {"generated_at": "2026-03-18T15:17:20.174034+00:00", "value": {"mitigation_remediation": ["Upgrade Soloud to version 20200207 or later as recommended by the vendor"], "summary": {"action": "Apply Patch", "impact": "Out-of-bounds read leading to potential memory corruption"}, "threat_synthesis": {"affected_systems": "Versions of Soloud preceding 20200207 are affected. The vulnerability is tied to the jarikomppa:soloud vendor and applies to any system utilizing the Soloud library that has not been upgraded beyond February 7, 2020. No specific subproduct or version list beyond the 20200207 suffix is provided; therefore, any earlier release is considered vulnerable.", "description_and_impact": "The vulnerability resides in jarikomppa's Soloud audio library, specifically within the drwav_read_pcm_frames_s16__msadpcm function in dr_wav.h. It permits an out-of-bounds read, causing a memory corruption condition when parsing WAV files. Because the flaw occurs during normal file parsing, an attacker could trigger it by delivering a crafted WAV file, resulting in data leakage or potential exploitation of the application memory. The weakness corresponds to improper bounds checking (CWE-119) and potential buffer under-read (CWE-125).", "risk_and_exploitability": "The CVSS score is 4.8, indicating a moderate severity. EPSS is reported as less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, reducing confirmed exploitation concern. Attack requires local execution; thus, an attacker must gain local access or influence application input. Exploitation can be performed by supplying a malicious WAV file to the affected library during read operations. Overall, the risk is contingent upon the need for local code execution or an attacker\u2019s ability to place files into the application\u2019s input stream."}}}}, "created": "2026-03-13T09:53:25.427214+00:00", "updated": "2026-03-20T15:50:02.476403+00:00", "vendors": ["jarikomppa", "jarikomppa$PRODUCT$soloud"], "weaknesses": ["CWE-119", "CWE-125"]}