Eric Young · Libsndfile · CVE-2017-6892
**Name of the Vulnerable Software and Affected Versions**
libsndfile version 1.0.28
**Description**
The issue is related to an error in the `aiff read chanmap()` function, which can cause an out-of-bounds read memory access. This can be exploited via a specially crafted AIFF file, potentially allowing a remote attacker to compromise data confidentiality, integrity, and availability.
**Recommendations**
For libsndfile version 1.0.28, consider avoiding the use of the `aiff read chanmap()` function until a patch is available. As a temporary workaround, restrict the processing of AIFF files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.