EUVD-2026-102291Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft short malformed Amiga module
-
ExploitVictim probes or plays file
-
ExecutionTrigger bufsize underflow in uade_filemagic()
-
ImpactOut-of-bounds read crashes application
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim application built on UADE 3.05 or earlier to open, probe, or play an attacker-supplied crafted short module file; the malformed input must be short enough to pass the format-probe bounds checks in uade_filemagic() yet trigger the unsigned bufsize subtraction underflow. No authentication is required (PR:N), but passive user interaction (UI:P) is needed - the file must be loaded/scanned by the UADE library. Limiting factors that reduce real-world risk: the attack vector is local (the file must be processed on the victim's machine), the impact is confined to a crash with no code execution or data disclosure, and the affected software is a niche Amiga audio player with limited deployment. |
| Impact | This is a moderate-severity denial-of-service issue, not a high-priority emergency. The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 and tells a consistent story: the only impact is availability (VA:H, an application crash), with no confidentiality or integrity impact (VC:N/VI:N), the attack is local (AV:L) and requires passive user interaction (UI:P) to open/probe/play a malicious file. No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC flag in the input, so exploitation status is: no public exploit identified at time of analysis - though a detailed third-party technical writeup (hackmd) and a VulnCheck advisory describe the root cause (unsigned bufsize subtraction wrapping) and even cite the vulnerable source lines, which lowers the barrier to reproducing a crash. CWE-125 (out-of-bounds read) combined with VA:H and VC:N indicates the practical outcome is a crash rather than information disclosure or code execution, so the real-world risk is a reliability/DoS concern against software that embeds UADE, not a compromise vector. Net assessment: a legitimate bug worth patching but low operational urgency, consistent across all available signals. |
| Exploit ScenarioDerived | An attacker crafts a deliberately short, malformed Amiga music module that satisfies UADE's format-probe bounds checks, then distributes it in a module collection, download, or website. When a victim's media player or tool using UADE ≤3.05 probes or plays the file, the unsigned bufsize subtraction underflows and uade_filemagic() reads far past the buffer, crashing the application. A public technical writeup documents the root cause and vulnerable code lines, but the realistic impact is denial of service rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Out-of-bounds read in UADE through 3.05 crashes applications that probe or play attacker-supplied Amiga module files, because an unsigned length subtraction in uade_filemagic() wraps around on deliberately short inputs. The malformed module must be small enough to slip past the format-probe bounds checks in amifilemagic.c yet trigger the bufsize underflow, after which the code reads far past the end of the buffer. Impact is limited to a denial of service, typically a segmentation fault that terminates the host player or library consumer; the attack requires the crafted file to be opened locally and the user to trigger the probe/playback path (CVSS:3.1/AV:L/PR:N/UI:R, availability-only), with no code execution, privilege gain, or data disclosure. The affected software is a niche Amiga emulation/audio library with limited deployment, so real-world risk is moderate; no public exploit identified at time of analysis, and the CVE is not in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis: the only code reference supplied points at the vulnerable amifilemagic.c region in commit 659d2fb2, not at a fixed revision or tagged release, and no fixed UADE version is named in the advisory data, so users should track the upstream repository (https://gitlab.com/uade-music-player/uade) for a corrected build. Until a fix lands, the most effective compensating control is input gating at the application layer: reject or quarantine module files below a safe minimum size and validate declared chunk/length fields before handing the file to UADE frontends or to any library call that reaches uade_filemagic(); the trade-off is that a minimum-size rule can block unusually small but legitimate modules, so it should be tuned and paired with content checksum allowlisting rather than used alone. Second, isolate the parsing step so a crash is contained and non-persistent - run probes in a short-lived child process with a timeout, or wrap UADE in an OS sandbox (seccomp/AppArmor, container, or a restricted low-privilege account); this does not remove the bug and adds per-file process overhead, but it converts a failed probe into a discarded result instead of a terminated host application. Third, avoid automatically probing untrusted files: require explicit user action to scan or play unknown modules, and keep UADE out of always-on indexing, mail-attachment, or upload-scanning pipelines where an attacker-supplied short file can reach the parser without deliberate user intent. Monitoring for abnormal termination of media players or scanner workers processing module files can provide early warning of attempts to exercise this path. Do not rely on generic 'defense in depth' measures alone; the specific triggering condition is a very short file reaching the unsigned-bufsize subtraction, so size and provenance controls at that boundary are the levers that matter.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UADE (Unix Amiga Delitracker Emulator) re-emulates Amiga custom audio hardware so that classic Amiga music modules can be replayed on modern systems. Before playback, its frontends run heuristic format detection in src/frontends/common/amifilemagic.c, which inspects file headers, computes remaining-length values, and compares them against expected structure sizes to decide which player engine to invoke. In the uade_filemagic() routine around lines 1069-1078 (permalink pinned at commit 659d2fb2dda66bb16ae43b46147135759f993d8e), an unsigned buffer-size subtraction is performed without first confirming that the buffer is longer than the value being subtracted; when the input file is very short, the subtraction wraps to a huge value, defeats the subsequent bounds comparisons, and lets the probe read well past the end of the allocated buffer. This is a classic CWE-125 out-of-bounds read whose root cause is an integer underflow on an unsigned size operand rather than a missing length check alone. The affected-product CPE is the wildcard cpe:2.3:a:uade:uade:*:*:*:*:*:*:*:*, meaning all released UADE versions up to and including 3.05 are in scope, and the impact propagates to any third-party application that embeds the library for file scanning or metadata extraction.
Know when Uade gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
A locally supplied file must be opened by the victim (AV:L, UI:R), no privileges are needed (PR:N), and the sole impact is an application crash, so C:N/I:N and A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applications that probe or play it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB