CVE-2019-8357

MEDIUM

An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c allows a NULL pointer dereference.

Affects 1 product across 1 vendor.

CVSS 3.05.5
EPSS1.6%
Percentile75th
PatchUnknown
CVSS Vector — Plain English Requires local access, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, no confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-476: NULL Pointer Dereference

Software attempts to use a NULL pointer, causing a crash and denial of service.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2019. A medium severity vulnerability affects Sound Exchange Project systems (CVE-2019-8357). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2019-GLOBAL-141675-M • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2019-8357?
This vulnerability was disclosed in 2019. A medium severity vulnerability affects Sound Exchange Project systems (CVE-2019-8357). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2019-8357?
CVE-2019-8357 has CVSS 5.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS: 1.6%.
Is CVE-2019-8357 actively exploited?
No confirmed active exploitation of CVE-2019-8357 as of 2026-05-30.
How do I remediate CVE-2019-8357?
Priority: MONITOR.
What systems are affected by CVE-2019-8357?
CVE-2019-8357 affects Sound Exchange Project Sound Exchange.
Vulnerability Details
CVE IDCVE-2019-8357
BSIDBS-2019-GLOBAL-141675-M BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published2019-02-15
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
NULL Pointer Dereference
SourceNVD
Official Description

An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c allows a NULL pointer dereference.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c allows a NULL pointer dereference. CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Sound Exchange Project Sound Exchange 14.4.2
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2799 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash0c537a8f0f4b1dce0fb031584c714e79ef81e47cfc006aca61d7205fd4123257b22a60e894dd95eb7bb4a6d8ae1aa59823ef83e4166a25a676f4850c3e83bb4c
Related CVEs affecting Sound Exchange Project
CVE-2021-3643 9.1 A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox lea... CVE-2021-40426 8.8 A heap-based buffer overflow vulnerability exists in the sphere.c start_read(... CVE-2023-34432 7.8 A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf fun... CVE-2023-34318 7.8 A heap buffer overflow vulnerability was found in sox, in the startread funct... CVE-2017-18189 7.5 In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a c...
View all Sound Exchange Project CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →