CVE-2014-8145: High – Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1

This vulnerability was disclosed in 2014. A high severity vulnerability affects Debian systems (CVE-2014-8145). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2014-GLOBAL-101449-H • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →

Frequently Asked Questions

What is CVE-2014-8145?

This vulnerability was disclosed in 2014. A high severity vulnerability affects Debian systems (CVE-2014-8145). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

What is the CVSS score for CVE-2014-8145?

CVE-2014-8145 has CVSS 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. EPSS: 7.7%.

Is CVE-2014-8145 actively exploited?

No confirmed active exploitation of CVE-2014-8145 as of 2026-09-25.

How do I remediate CVE-2014-8145?

Priority: MEDIUM.

What systems are affected by CVE-2014-8145?

CVE-2014-8145 affects Debian Debian Linux; Oracle Solaris; Sound Exchange Project Sound Exchange.

Vulnerability Details

CVE ID	`CVE-2014-8145`
BSID	`BS-2014-GLOBAL-101449-H` BreachSpider Global ID
CVSS Vector	`AV:N/AC:L/Au:N/C:P/I:P/A:P`
Published	2014-12-31
Last Modified	2026-06-17
ICS Relevance	15%
Weakness (CWE)	Improper Restriction of Operations within Memory Buffer
Source	NVD

Official Description

Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or (2) AdpcmReadBlock function.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or (2) AdpcmReadBlock function. CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P.

Exploitation Likelihood: LOW

Affected Products

Vendor	Product	Affected Versions
Debian	Debian Linux	`7.0` `8.0`
Oracle	Solaris	`11.2`
Sound Exchange Project	Sound Exchange	`≤ 14.4.1`

Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence

● Threat Intelligence Validated: October 2026 | Threat Age: 4306 Days

CISA known-exploited	Not in KEV catalog
Public Exploit	Not confirmed
PoC Code	Not confirmed

AI Enrichment Record — provenance & audit hash

Model	`rule-based-v1`
Confidence	MEDIUM
Enriched At	2026-05-24
SHA-512 Audit Hash	`9833eadf4beeae220d24884ad82c917678857c22a352bf84433c48a22f5e6c9d10ffee0a12b61d1d8b24b7579438b4c822a4feddbd9a76534520d62b6b41867a`

Related CVEs affecting Debian

CVE-2012-0444 10.0 Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 ... CVE-2013-2863 10.0 Google Chrome before 27.0.1453.110 does not properly handle SSL sockets, whic... CVE-2015-2724 10.0 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox... CVE-2017-16845 10.0 hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during gue... CVE-1999-0698 10.0 Denial of service in IP protocol logger (ippl) on Red Hat and Debian Linux.

View all Debian CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →