CVE-2012-2106: Integer overflow in the pv_import function in util/pv_import.c in Csound 5.16.6, when converting a file, al...

Security readout for executives and security teams

Csound 5.16.6 can mishandle a specially crafted file during conversion. The bug can corrupt heap memory and may allow attacker-controlled code to run if a vulnerable system processes an untrusted file. Business risk is highest where Csound is exposed through automated media, research, or content-processing workflows. Exposure is likely limited to systems with Csound 5.16.6 or vulnerable csound5 packages installed, especially where users or external systems can submit files for conversion. Internet exposure depends on whether Csound is reachable through a web service, batch processor, or shared content pipeline. Prioritize remediation where Csound processes files from customers, partners, public uploads, or shared research environments. Internal-only desktop installations are lower urgency but should still be updated through normal patch cycles. Mitigation focus: Update Csound or csound5 packages using vendor or distribution guidance.; Review upstream commits and distro advisories for the fixed build lineage.; Block untrusted file conversion until vulnerable installations are upgraded..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.