CVE-2026-129264
Deferred Deferred - Pending Action

Out-of-Bounds Write in sox_ng VOC Decoder

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: VulDB

Description
A security vulnerability has been detected in sox_ng up to 14.8.1. Affected by this issue is the function read_samples_voc of the file src/voc.c of the component VOC Decoder. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 0b40408b. A patch should be applied to remediate this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-129264
EUVD
EUVD-2026-125944

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
n/a sox_ng 14.8.0
n/a sox_ng 14.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds write issue in the VOC Decoder component of sox_ng up to version 14.8.1. It exists in the function read_samples_voc within the file src/voc.c. An attacker can remotely exploit this flaw to write data outside the intended memory bounds, potentially causing crashes or arbitrary code execution.

Detection Guidance

The provided context does not include specific detection commands for this vulnerability. However, you can monitor for unusual activity in the VOC decoder component of sox_ng versions up to 14.8.1. Check for out-of-bounds write attempts in logs or system calls related to voc.c.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code, crash the application, or gain unauthorized access to system resources. The remote attack vector means it can be triggered without physical access to the target system.

Compliance Impact

The provided CVE data does not specify direct impacts on GDPR or HIPAA compliance. However, the vulnerability involves an out-of-bounds write in the VOC Decoder component, which could lead to remote code execution or data corruption. Such issues may compromise data integrity and confidentiality, potentially violating GDPR principles like security of processing (Article 32) or HIPAA's integrity and availability requirements.

Mitigation Strategies
  • Update sox_ng to the patched version using the commit 0b40408b or later.
  • Disable or restrict access to the VOC decoder functionality if an update is not immediately available.
  • Monitor network traffic for signs of exploitation attempts targeting the VOC decoder.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...