USN-8612-1: Roc Toolkit vulnerability
It was discovered that Roc Toolkit incorrectly handled WAV files with a malformed "smpl" chunk. An attacker could use this issue to cause Roc Toolkit to crash, resulting in a denial of service, or possibly execute arbitrary code.
CSIRTS triage
- What
- Roc Toolkit incorrectly handled WAV files with a malformed "smpl" chunk, leading to potential crashes or arbitrary code execution.
- Who is affected
- Deployments of Roc Toolkit that process WAV files.
- Urgency
- Remediation is urgent due to the potential for denial of service and arbitrary code execution.
- Action
- Update to the latest version of Roc Toolkit.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Roc Toolkit
Get an email when a new Roc Toolkit advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://ubuntu.com/security/notices/USN-8612-1
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-290220.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-29022 | coverage & exploitation status | NVD · CVE.org |
More from Ubuntu Security Notices
- highUSN-8620-4: Linux kernel (Intel IoTG) vulnerabilities2026-07-31
- highUSN-8620-3: Linux kernel (Intel IoTG) vulnerabilities2026-07-31
- unknownUSN-8625-1: OpenSSL vulnerability2026-07-30
- unknownUSN-8624-1: Sinatra vulnerability2026-07-29
- unknownUSN-8623-1: Linux kernel (NVIDIA) vulnerabilities2026-07-29