CVE catalog
CVE-2026-29022
dr_libs-devel-20260901-1.1 on GA media
- Severity
- High · CVSS 7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.22% · Oct 25, 2026
It was discovered that Roc Toolkit incorrectly handled WAV files with a malformed "smpl" chunk. An attacker could use this issue to cause Roc Toolkit to crash, resulting in a denial of service, or possibly execute arbitrary code.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | roc-toolkit | 26.04 | 0.4.0+dfsg-5ubuntu1 | vulnerable |
| Ubuntu | roc-toolkit | 26.04 | 0.4.0+dfsg-5ubuntu3 | vulnerable |
| Ubuntu | roc-toolkit | 26.04 | 0.4.0+dfsg-5ubuntu3.1 | fixed |
| Ubuntu | octave-ltfat | 16.04 | 2.1.0+dfsg-1 | vulnerable |
| Ubuntu | octave-ltfat | 16.04 | 2.1.1+dfsg-1 | vulnerable |
| Ubuntu | octave-ltfat | 16.04 | 2.1.1+dfsg-2 | vulnerable |
| Ubuntu | qtads | 16.04 | 2.1.6-1 | vulnerable |
| Ubuntu | octave-ltfat | 18.04 | 2.2.0+dfsg-4 | vulnerable |
| Ubuntu | octave-ltfat | 18.04 | 2.2.0+dfsg-5 | vulnerable |
| Ubuntu | octave-ltfat | 18.04 | 2.2.0+dfsg-7 | vulnerable |
| Ubuntu | qtads | 18.04 | 2.1.6-1.1 | vulnerable |
| Ubuntu | faudio | 20.04 | 19.07-1 | vulnerable |
| Ubuntu | faudio | 20.04 | 19.11-1 | vulnerable |
| Ubuntu | faudio | 20.04 | 19.12-1 | vulnerable |
| Ubuntu | faudio | 20.04 | 20.04-2 | vulnerable |
| Ubuntu | octave-ltfat | 20.04 | 2.3.1+dfsg-2 | vulnerable |
| Ubuntu | octave-ltfat | 20.04 | 2.3.1+dfsg-2build1 | vulnerable |
| Ubuntu | octave-ltfat | 20.04 | 2.3.1+dfsg-3 | vulnerable |
| Ubuntu | octave-ltfat | 20.04 | 2.3.1+dfsg-3build1 | vulnerable |
| Ubuntu | qtads | 20.04 | 2.1.6-1.1 | vulnerable |
| Ubuntu | qtads | 20.04 | 2.1.7-0.1 | vulnerable |
| Ubuntu | qtads | 20.04 | 2.1.7-0.1build1 | vulnerable |
| Ubuntu | faudio | 22.04 | 21.02-1 | vulnerable |
| Ubuntu | faudio | 22.04 | 21.11-1 | vulnerable |
| Ubuntu | faudio | 22.04 | 21.12-1 | vulnerable |
| Ubuntu | faudio | 22.04 | 22.01-1 | vulnerable |
| Ubuntu | faudio | 22.04 | 22.02-1 | vulnerable |
| Ubuntu | octave-ltfat | 22.04 | 2.3.1+dfsg-8 | vulnerable |
| Ubuntu | octave-ltfat | 22.04 | 2.3.1+dfsg-10 | vulnerable |
| Ubuntu | octave-ltfat | 22.04 | 2.3.1+dfsg-10build1 | vulnerable |
| Ubuntu | qtads | 22.04 | 2.1.7-0.1build1 | vulnerable |
| Ubuntu | dosbox-x | 24.04 | 2023.10.06+dfsg-1 | vulnerable |
| Ubuntu | dosbox-x | 24.04 | 2024.03.01+dfsg-1build1 | vulnerable |
| Ubuntu | dosbox-x | 24.04 | 2024.03.01+dfsg-1build2 | vulnerable |
| Ubuntu | faudio | 24.04 | 23.07+dfsg-1 | vulnerable |
| Ubuntu | faudio | 24.04 | 23.08+dfsg-1 | vulnerable |
| Ubuntu | faudio | 24.04 | 23.11+dfsg-1 | vulnerable |
| Ubuntu | faudio | 24.04 | 24.02+dfsg-1 | vulnerable |
| Ubuntu | faudio | 24.04 | 24.02+dfsg-1build1 | vulnerable |
| Ubuntu | faudio | 24.04 | 24.02+dfsg-1build2 | vulnerable |
| Ubuntu | octave-ltfat | 24.04 | 2.5.0+dfsg-2ubuntu1 | vulnerable |
| Ubuntu | octave-ltfat | 24.04 | 2.6.0+dfsg-6ubuntu1 | vulnerable |
| Ubuntu | qtads | 24.04 | 3.4.0+dfsg-1 | vulnerable |
| Ubuntu | qtads | 24.04 | 3.4.0+dfsg-1build1 | vulnerable |
| Ubuntu | qtads | 24.04 | 3.4.0+dfsg-1build2 | vulnerable |
| Ubuntu | qtads | 24.04 | 3.4.0+dfsg-1build3 | vulnerable |
| Ubuntu | dosbox-x | 25.10 | 2025.02.01+dfsg-1 | vulnerable |
| Ubuntu | dosbox-x | 25.10 | 2025.02.01+dfsg-3 | vulnerable |
| Ubuntu | faudio | 25.10 | 25.03+dfsg-2 | vulnerable |
| Ubuntu | faudio | 25.10 | 25.04+dfsg-1 | vulnerable |
| Ubuntu | faudio | 25.10 | 25.05+dfsg-1 | vulnerable |
| Ubuntu | octave-ltfat | 25.10 | 2.6.0+dfsg-6ubuntu2 | vulnerable |
| Ubuntu | qtads | 25.10 | 3.4.0+dfsg-1build3 | vulnerable |
| Ubuntu | roc-toolkit | 25.10 | 0.4.0+dfsg-4ubuntu1 | vulnerable |
| Ubuntu | roc-toolkit | 25.10 | 0.4.0+dfsg-5ubuntu1 | vulnerable |
| Ubuntu | dosbox-x | 26.10 | 2026.01.02+dfsg-2 | vulnerable |
| Ubuntu | dosbox-x | 26.10 | 2026.06.02+dfsg-1 | vulnerable |
| Ubuntu | dosbox-x | 26.10 | 2026.07.02+dfsg-1 | vulnerable |
| Ubuntu | dosbox-x | 26.10 | 2026.08.02+dfsg-1 | vulnerable |
| Ubuntu | dosbox-x | 26.10 | 2026.08.02+dfsg-2 | vulnerable |
| Ubuntu | faudio | 26.10 | 26.01+dfsg-1 | vulnerable |
| Ubuntu | faudio | 26.10 | 26.05+dfsg-1 | vulnerable |
| Ubuntu | faudio | 26.10 | 26.06+dfsg-1 | vulnerable |
| Ubuntu | faudio | 26.10 | 26.07+dfsg-1 | vulnerable |
| Ubuntu | octave-ltfat | 26.10 | 2.6.0+dfsg-7build1 | vulnerable |
| Ubuntu | qtads | 26.10 | 3.4.0+dfsg-2 | vulnerable |
| Ubuntu | dosbox-x | 26.04 | 2025.02.01+dfsg-3 | vulnerable |
| Ubuntu | dosbox-x | 26.04 | 2025.10.07+dfsg-1 | vulnerable |
| Ubuntu | dosbox-x | 26.04 | 2025.12.01+dfsg-1 | vulnerable |
| Ubuntu | dosbox-x | 26.04 | 2026.01.02+dfsg-1 | vulnerable |
| Ubuntu | dosbox-x | 26.04 | 2026.01.02+dfsg-2 | vulnerable |
| Ubuntu | faudio | 26.04 | 25.05+dfsg-1 | vulnerable |
| Ubuntu | faudio | 26.04 | 25.09+dfsg-1 | vulnerable |
| Ubuntu | faudio | 26.04 | 25.12+dfsg-1 | vulnerable |
| Ubuntu | faudio | 26.04 | 25.12+dfsg-2 | vulnerable |
| Ubuntu | faudio | 26.04 | 26.01+dfsg-1 | vulnerable |
| Ubuntu | octave-ltfat | 26.04 | 2.6.0+dfsg-6ubuntu2 | vulnerable |
| Ubuntu | octave-ltfat | 26.04 | 2.6.0+dfsg-7 | vulnerable |
| Ubuntu | octave-ltfat | 26.04 | 2.6.0+dfsg-7build1 | vulnerable |
| Ubuntu | qtads | 26.04 | 3.4.0+dfsg-1build3 | vulnerable |
| Ubuntu | qtads | 26.04 | 3.4.0+dfsg-2 | vulnerable |
| Ubuntu | roc-toolkit | 26.04 | 0.4.0+dfsg-5ubuntu1 | vulnerable |
| Ubuntu | roc-toolkit | 26.04 | 0.4.0+dfsg-5ubuntu3 | vulnerable |
| Ubuntu | roc-toolkit | 26.04 | 0.4.0+dfsg-5ubuntu3.1 | fixed |
| Opensuse | dr_libs | tumbleweed | 20260901-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Ubuntu | roc-toolkit | deb | 26.04 | 0.4.0+dfsg-5ubuntu3.1 | Not reported | USN-8612-1 | Not reported |
| Ubuntu | roc-toolkit | deb | 26.04 | 0.4.0+dfsg-5ubuntu3.1 | Not reported | UBUNTU-CVE-2026-29022 | Not reported |
| Opensuse | dr_libs | rpm | tumbleweed | 20260901-1.1 | Not reported | OPENSUSE-SU-2026:12176-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [dr_libs-devel]Unknown
Source package: [dr_libs]
Details (1)
20260315-1.2· noarch · tumbleweedUnknown · Fixed:
20260901-1.1Version impact unknown
pypi · dr_libs · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12176-1.json]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-29022]
- [https://osv.dev/vulnerability/USN-8612-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:12176-1]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29022.json]
[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]