ReadyMedia (MiniDLNA) EUVD-2026-115624

Exploitation requires the attacker to place a crafted DFF audio file (one with an oversized PROP chunk size) into a filesystem directory that ReadyMedia is configured to monitor; the inotify watcher then parses it automatically with no user interaction. The concrete prerequisite is therefore write access to a monitored media path - such as an exposed network share (SMB/NFS), an upload pathway feeding that directory, or a low-privilege account on the host - which is why the vector carries PR:L rather than PR:N. The outcome is limited by build configuration: unprotected builds are exploitable for remote code execution, whereas hardened builds with stack protections degrade the result to denial of service. Affected deployments are limited to ReadyMedia (MiniDLNA) versions 1.3.0 through 1.3.3.

This is a credible, near-term priority rather than an inflated high-CVSS score, but it is not a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7) indicates a network-reachable, low-complexity flaw with no attacker-controlled attack requirement and no user interaction, yielding full confidentiality, integrity, and availability impact on the vulnerable system. The PR:L metric is the key qualifier: exploitation is not fully unauthenticated - it depends on the attacker being able to place a file into a directory ReadyMedia monitors, so this maps to a low-privilege or share-write capability rather than a pure anonymous internet attack. The description also makes clear the impact is build-dependent: remote code execution on unprotected builds versus denial of service on hardened builds with stack protections, so the VI/VC:H outcome is not guaranteed on every deployment. The input provides no EPSS score and no KEV listing, so widespread or active exploitation cannot be asserted. The vuln.today decision label is 'this_week,' and VulnCheck is the reporting source; a public write-up/PoC reference exists but is not verified as working exploit code, so this sits in the 'patch promptly' tier. In short, signals are internally consistent (serious memory-corruption bug, patch available, credible reporter) with the main uncertainty being real-world exploitation volume, which the available data does not quantify.

An attacker with the ability to write to a media folder that ReadyMedia indexes - for example via an exposed SMB/NFS share, an upload feature, or a compromised low-privilege account on a NAS or router - drops a malicious DFF audio file whose PROP chunk declares an oversized length. ReadyMedia's inotify watcher automatically parses the new file, uses the unvalidated size to size a variable-length stack array, and reads file data into it, overflowing the stack. On unprotected builds this yields remote code execution as the ReadyMedia process; on builds with stack protections it typically results in a crash (denial of service). A public PoC reference exists but is not verified as working exploit code.