Dr Libs
Monthly
Heap buffer overflow in dr_libs dr_wav.h enables arbitrary code execution in 32-bit applications that parse untrusted W64 WAV files containing CUE chunk metadata. The flaw stems from a two-stage allocation mismatch: stage-1 capacity estimation silently truncates a 64-bit W64 chunk size to 32-bit size_t, under-allocating heap space, while stage-2 writes using the full attacker-controlled cuePointCount field without validating against that flawed estimate. The sole runtime guard (DRWAV_ASSERT) is compiled out under -DNDEBUG, the default for release builds, making exploitation silent in production. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Denial of service in dr_libs 0.13.3 and earlier enables local attackers with user privileges to exhaust system memory by supplying malicious PICTURE metadata blocks with oversized length fields in FLAC streams. The vulnerability resides in improper bounds checking during metadata parsing, allowing uncontrolled memory allocation that crashes applications processing affected audio files. No patch is currently available.
Heap buffer overflow in dr_libs 0.14.4 and earlier allows attackers to corrupt memory by supplying maliciously crafted WAV files to any application using drwav_init_*_with_metadata() functions. The vulnerability exploits inconsistent validation of sample loop counts between processing passes, enabling 36 bytes of attacker-controlled data to overflow heap allocations. Public exploit code exists for this vulnerability.
Heap buffer overflow in dr_libs dr_wav.h enables arbitrary code execution in 32-bit applications that parse untrusted W64 WAV files containing CUE chunk metadata. The flaw stems from a two-stage allocation mismatch: stage-1 capacity estimation silently truncates a 64-bit W64 chunk size to 32-bit size_t, under-allocating heap space, while stage-2 writes using the full attacker-controlled cuePointCount field without validating against that flawed estimate. The sole runtime guard (DRWAV_ASSERT) is compiled out under -DNDEBUG, the default for release builds, making exploitation silent in production. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Denial of service in dr_libs 0.13.3 and earlier enables local attackers with user privileges to exhaust system memory by supplying malicious PICTURE metadata blocks with oversized length fields in FLAC streams. The vulnerability resides in improper bounds checking during metadata parsing, allowing uncontrolled memory allocation that crashes applications processing affected audio files. No patch is currently available.
Heap buffer overflow in dr_libs 0.14.4 and earlier allows attackers to corrupt memory by supplying maliciously crafted WAV files to any application using drwav_init_*_with_metadata() functions. The vulnerability exploits inconsistent validation of sample loop counts between processing passes, enabling 36 bytes of attacker-controlled data to overflow heap allocations. Public exploit code exists for this vulnerability.