CVE-2004-0557: Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through...

Security readout for executives and security teams

CVE-2004-0557 is an old SoX WAV parsing flaw. A malicious WAV file could trigger buffer overflows and potentially run code in the context of the process handling the file. Business risk is highest where legacy SoX processes untrusted audio automatically. Likely exposure is legacy Unix/Linux hosts, appliances, or media pipelines using SoX 12.17.2-12.17.4 to parse WAV files, especially from uploads, email attachments, or automated conversion queues. Maintained systems are less likely exposed but should be verified. Prioritize remediation for any internet-facing or partner-facing workflow that processes WAV files with legacy SoX. For ordinary managed endpoints, validate exposure first, because the issue is old and current package maintenance may already have removed the risk. Mitigation focus: Inventory all SoX installations and identify versions 12.17.2 through 12.17.4.; Apply relevant vendor package updates from Red Hat, Debian, Gentoo, Fedora, or your OS vendor.; Disable automated processing of untrusted WAV files until affected systems are updated..

Prepared

Jun 30, 2026, 04:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.