CVE-2021-40426

HIGH

A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e. A specially-crafted file can lead to a heap ...

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS2.2%
Percentile82th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-122: Heap-Based Buffer Overflow

Buffer overflow corrupting dynamically allocated heap memory, exploitable for arbitrary code execution.

CWE-787: Out-of-Bounds Write

Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.

Related Attack Patterns (CAPEC)
CAPEC-92 Forced Integer Overflow
via CWE-122

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e, which can be exploited by providing a specially-crafted file.

BSID: BS-2022-GLOBAL-307290-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-40426?
A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e, which can be exploited by providing a specially-crafted file.
What is the CVSS score for CVE-2021-40426?
CVE-2021-40426 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 2.2%.
Is CVE-2021-40426 actively exploited?
No confirmed active exploitation of CVE-2021-40426 as of 2026-05-30.
How do I remediate CVE-2021-40426?
Priority: IMMEDIATE.
What systems are affected by CVE-2021-40426?
CVE-2021-40426 affects Sound Exchange Project Sound Exchange.
Vulnerability Details
CVE IDCVE-2021-40426
BSIDBS-2022-GLOBAL-307290-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2022-04-14
Last Modified2025-06-24
ICS Relevance15%
Weakness (CWE)
Heap-Based Buffer OverflowOut-of-Bounds Write
SourceNVD
Official Description

A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can craft a malicious file that, when processed by the vulnerable version of libsox, triggers a heap buffer overflow. This could lead to arbitrary code execution, denial of service, or other unspecified impacts.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Sound Exchange Project Sound Exchange 14.4.2
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1645 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashe8482dcba023e1d29b7d28be38dedc67cc6394521b0fb48938f7dc0596eaa2d8b9cb81a4dcbb7ee8d957976353364dc22d0d17c9b08586102829a7a24c9712aa
Related CVEs affecting Sound Exchange Project
CVE-2021-3643 9.1 A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox lea... CVE-2023-34318 7.8 A heap buffer overflow vulnerability was found in sox, in the startread funct... CVE-2023-34432 7.8 A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf fun... CVE-2017-18189 7.5 In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a c... CVE-2014-8145 7.5 Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earli...
View all Sound Exchange Project CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →