CVE-2026-129264

CVSS 5.5 (medium) · published 2026-11-14

A security vulnerability has been detected in sox_ng up to 14.8.1. Affected by this issue is the function read_samples_voc of the file src/voc.c of the component VOC Decoder. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 0b40408b. A patch should be applied to remediate this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Weakness: CWE-119, CWE-787

Source: NVD CVE-2026-129264

References

• https://codeberg.org/sox_ng/sox_ng/commit/0b40408b
• https://codeberg.org/sox_ng/sox_ng/issues/873
• https://codeberg.org/suyuanwang/Test_sox/
• https://vuldb.com/cve/CVE-2026-129264
• https://vuldb.com/submit/1043408
• https://vuldb.com/vuln/437307
• https://vuldb.com/vuln/437307/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.