Skip to content
Fencer Vulns
medium 5.5

CVE-2019-8356 json

An issue was discovered in SoX 14.4.2.

published 2019-02-15 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-17746

cvss
5.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.

Patch / fix

  • sox Debian 13, Debian 12 14.4.2+git20190427-1

debian advisories DEBIAN-CVE-2019-8356

  • sox Ubuntu 16.04 LTS 14.4.1-5+deb8u4ubuntu0.1
  • sox Ubuntu 18.04 LTS 14.4.2-3ubuntu0.18.04.1
  • sox Ubuntu Pro 14.04 LTS 14.4.1-3ubuntu1.1+esm1

ubuntu advisories UBUNTU-CVE-2019-8356

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • sox Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 14.4.2-r5
  • sox Alpine 3.9 14.4.2-r3

alpine advisories ALPINE-CVE-2019-8356

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-8356 updated cvss 6.7

sox: stack-based buffer overflow in bitrv2 in fft4g.c

  • Red Hat Enterprise Linux 7 sox
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 5 sox Red Hat Enterprise Linux 6 sox
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.80% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • sourceforge.net https://sourceforge.net/p/sox/bugs/321 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

Classification

Weakness
  • CWE-129 Improper Validation of Array Index
  • CWE-787 Out-of-bounds Write

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.