CVE-2019-8355: Sound Exchange Project Sound Exchange

Medium severity, CVSS 5.5. EPSS: 1.7% chance of exploitation in the next 30 days.

An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channels_start in remix.c.

Affected products

• Sound Exchange Project Sound Exchange: version 14.4.2 only

Published 2019-02-15. Last modified 2026-06-17.