CVE-2025-56226: 
NixOS vulnerability analysis and mitigation

CVE-2025-56226 is a memory leak vulnerability in libsndfile versions 1.1.0 through 1.2.2, located in the mpeg_l3_encoder_init() function within src/mpeg_l3_encode.c. The flaw was reported by researcher Sisyphus-wang and published on January 14, 2026. It affects the sndfile-convert utility's MP3 encoding path and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, GitHub Gist).

The root cause (CWE-401: Missing Release of Memory after Effective Lifetime) is an incomplete initialization sequence combined with early error returns in mpeg_l3_encoder_init(). Specifically, lame_init() successfully allocates encoder resources, but if a subsequent call to lame_set_out_samplerate() fails (e.g., due to an unsupported sample rate), the function returns SFE_MPEG_BAD_SAMPLERATE before the cleanup callback psf->codec_close is set — leaving the allocated memory unreleased. An attacker can trigger this path by supplying a crafted audio file with an unsupported sample rate to any application using the affected libsndfile version for MP3 encoding. A public PoC and detailed root cause analysis are available (GitHub Gist, GitHub Issue).

Successful exploitation causes memory exhaustion in the affected process, leading to denial of service conditions such as system instability or service unavailability. The vulnerability has no confidentiality or integrity impact; only availability is affected (Low per CVSS). Because the flaw is network-reachable and requires no authentication or user interaction, any service that processes attacker-supplied audio files using libsndfile 1.1.0–1.2.2 is at risk of gradual memory exhaustion (Feedly).

Public proof-of-concept code and a detailed write-up are available via GitHub, demonstrating the leak using AddressSanitizer. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.039% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Gist, Feedly).

1. Identify target: Locate a service or application that uses libsndfile versions 1.1.0–1.2.2 for audio file processing or conversion, particularly one that accepts user-supplied audio files for MP3 encoding.
2. Craft malicious input: Prepare an audio file (e.g., RF64/WAV format) with a sample rate not supported by the MPEG-1/2/2.5 encoder (i.e., not one of: 8000, 11025, 12000, 16000, 22050, 24000, 32000, 44100, or 48000 Hz).
3. Submit the file: Supply the crafted file to the target application (e.g., via sndfile-convert poc.wav output.mp3) or through any network-accessible interface that invokes the MP3 encoding path.
4. Trigger the leak: The lame_init() call allocates encoder resources; lame_set_out_samplerate() then fails, causing an early return before psf->codec_close is set, leaving ~10 KB of memory unreleased per invocation.
5. Repeat for DoS: Repeatedly submit crafted files to accumulate leaked memory, eventually exhausting available memory and causing the service to become unstable or crash (GitHub Gist, GitHub Issue).

• Process: Steadily increasing memory consumption in processes using libsndfile (e.g., sndfile-convert) without corresponding release; RSS/VSZ growth visible via top, ps, or system monitoring tools.
• Logs: Application error messages such as Error : MPEG-1/2/2.5 only supports sample rates of 8000, 11025, 12000, 16000, 22050, 24000, 32000, 44100, and 48000 appearing repeatedly in application logs, potentially indicating repeated submission of malformed files.
• Network: High volume of audio file upload or conversion requests from a single source IP, particularly files that consistently trigger encoding errors.
• File System: Presence of audio files with unusual or non-standard sample rates in upload or processing directories (GitHub Issue).

The vulnerability has been fixed in the official libsndfile repository (referenced in PR/issue #1090). Organizations should upgrade libsndfile to a version newer than 1.2.2 as soon as a patched release is available. Microsoft released security updates addressing this vulnerability on January 21, 2026, for Azure Linux 3 packages. As a temporary workaround, restrict network access to services that process audio files using affected libsndfile versions, and monitor for unusual memory consumption patterns (Microsoft MSRC, Feedly).

Red Hat has acknowledged the vulnerability and published a CVE entry. The Yocto Project security mailing list discussed the issue across multiple messages, and openSUSE issued a security announcement addressing libsndfile. Debian also referenced the vulnerability in a March 2026 news item. Community reaction has been low-key given the Medium severity and limited exploitation potential (Red Hat, openSUSE).