CVE-2021-3643

CRITICAL

A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sen...

Affects 1 product across 1 vendor.

CVSS 3.19.1
EPSS1.6%
Percentile75th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-120: Buffer Copy without Checking Size (Classic Buffer Overflow)

Program copies data to a buffer without verifying the source data fits within the destination.

CWE-125: Out-of-Bounds Read

Software reads data past the boundary of an allocated buffer, leaking sensitive information or causing crashes.

Related Attack Patterns (CAPEC)
CAPEC-8 Buffer Overflow in an API Call
via CWE-120
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-120
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-120
CAPEC-14 Client-side Injection-induced Buffer Overflow
via CWE-120
CAPEC-24 Filter Failure through Buffer Overflow
via CWE-120
Show all 14

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A global-buffer-overflow vulnerability exists in the lsx_adpcm_init function within libsox of sox version 14.4.1, allowing an attacker to input a malicious file to disclose sensitive information.

BSID: BS-2022-GLOBAL-306827-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-3643?
A global-buffer-overflow vulnerability exists in the lsx_adpcm_init function within libsox of sox version 14.4.1, allowing an attacker to input a malicious file to disclose sensitive information.
What is the CVSS score for CVE-2021-3643?
CVE-2021-3643 has CVSS 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS: 1.6%.
Is CVE-2021-3643 actively exploited?
No confirmed active exploitation of CVE-2021-3643 as of 2026-05-30.
How do I remediate CVE-2021-3643?
Priority: IMMEDIATE.
What systems are affected by CVE-2021-3643?
CVE-2021-3643 affects Sound Exchange Project Sound Exchange.
Vulnerability Details
CVE IDCVE-2021-3643
BSIDBS-2022-GLOBAL-306827-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Published2022-05-02
Last Modified2025-06-27
ICS Relevance15%
Weakness (CWE)
Buffer Copy without Checking Size (Classic Buffer Overflow)Out-of-Bounds Read
SourceNVD
Official Description

A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by providing a specially crafted file to a program that uses the affected version of libsox, potentially leading to information disclosure.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Sound Exchange Project Sound Exchange 14.4.1
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1627 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash231ab3587d2999bef68b0dc539b343b513bddfbced2e828b474c37753ceb761ae3bf8aa2a2de38de964a81f9a98bf72991b98ba99cda02f752fba5c2aa9219ec
Related CVEs affecting Sound Exchange Project
CVE-2021-40426 8.8 A heap-based buffer overflow vulnerability exists in the sphere.c start_read(... CVE-2023-34318 7.8 A heap buffer overflow vulnerability was found in sox, in the startread funct... CVE-2023-34432 7.8 A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf fun... CVE-2017-18189 7.5 In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a c... CVE-2014-8145 7.5 Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earli...
View all Sound Exchange Project CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.1 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →