Vulnerability Spotlight: Heap overflow in Sound Exchange libsox library

Summary: Cisco Talos discovered an exploitable heap-based buffer overflow in the start_read() functionality of sphere.c in the Sound Exchange libsox library, tracked as TALOS-2021-1434 (CVE-2021-40426), which an attacker can trigger by providing a malicious file. The flaw exists in how the library handles NIST Speech Header Resources (SPHERE) files used for speech recognition, and Talos confirmed versions 14.4.2 and master commit 42b3557e could be exploited, releasing details despite no official update from Sound Exchange.
Bottom line: Talos published the flaw with no vendor fix in place, so anyone running libsox 14.4.2 or master commit 42b3557e has no patch to apply and must rely on detection - Snort rules 58836 and 58837 - against malicious SPHERE files.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-40426
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026