Mackron
Monthly
Heap buffer overflow in dr_libs dr_wav.h enables arbitrary code execution in 32-bit applications that parse untrusted W64 WAV files containing CUE chunk metadata. The flaw stems from a two-stage allocation mismatch: stage-1 capacity estimation silently truncates a 64-bit W64 chunk size to 32-bit size_t, under-allocating heap space, while stage-2 writes using the full attacker-controlled cuePointCount field without validating against that flawed estimate. The sole runtime guard (DRWAV_ASSERT) is compiled out under -DNDEBUG, the default for release builds, making exploitation silent in production. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Denial of service in dr_libs 0.13.3 and earlier enables local attackers with user privileges to exhaust system memory by supplying malicious PICTURE metadata blocks with oversized length fields in FLAC streams. The vulnerability resides in improper bounds checking during metadata parsing, allowing uncontrolled memory allocation that crashes applications processing affected audio files. No patch is currently available.
Miniaudio versions 0.11.25 and earlier are vulnerable to a heap out-of-bounds read in the WAV BEXT metadata parser when processing specially crafted WAV files. An attacker can exploit improper null-termination handling in the coding history field to trigger memory access violations, causing application crashes or denial of service. No patch is currently available for affected Debian and Miniaudio distributions.
Heap buffer overflow in dr_libs 0.14.4 and earlier allows attackers to corrupt memory by supplying maliciously crafted WAV files to any application using drwav_init_*_with_metadata() functions. The vulnerability exploits inconsistent validation of sample loop counts between processing passes, enabling 36 bytes of attacker-controlled data to overflow heap allocations. Public exploit code exists for this vulnerability.
An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality of Miniaudio miniaudio v0.11.21. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Miniaudio 0.10.35 has an integer-based buffer overflow caused by an out-of-bounds left shift in drwav_bytes_to_u32 in miniaudio.h. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in ma_default_vfs_close__stdio in miniaudio.h. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Heap buffer overflow in dr_libs dr_wav.h enables arbitrary code execution in 32-bit applications that parse untrusted W64 WAV files containing CUE chunk metadata. The flaw stems from a two-stage allocation mismatch: stage-1 capacity estimation silently truncates a 64-bit W64 chunk size to 32-bit size_t, under-allocating heap space, while stage-2 writes using the full attacker-controlled cuePointCount field without validating against that flawed estimate. The sole runtime guard (DRWAV_ASSERT) is compiled out under -DNDEBUG, the default for release builds, making exploitation silent in production. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Denial of service in dr_libs 0.13.3 and earlier enables local attackers with user privileges to exhaust system memory by supplying malicious PICTURE metadata blocks with oversized length fields in FLAC streams. The vulnerability resides in improper bounds checking during metadata parsing, allowing uncontrolled memory allocation that crashes applications processing affected audio files. No patch is currently available.
Miniaudio versions 0.11.25 and earlier are vulnerable to a heap out-of-bounds read in the WAV BEXT metadata parser when processing specially crafted WAV files. An attacker can exploit improper null-termination handling in the coding history field to trigger memory access violations, causing application crashes or denial of service. No patch is currently available for affected Debian and Miniaudio distributions.
Heap buffer overflow in dr_libs 0.14.4 and earlier allows attackers to corrupt memory by supplying maliciously crafted WAV files to any application using drwav_init_*_with_metadata() functions. The vulnerability exploits inconsistent validation of sample loop counts between processing passes, enabling 36 bytes of attacker-controlled data to overflow heap allocations. Public exploit code exists for this vulnerability.
An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality of Miniaudio miniaudio v0.11.21. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Miniaudio 0.10.35 has an integer-based buffer overflow caused by an out-of-bounds left shift in drwav_bytes_to_u32 in miniaudio.h. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in ma_default_vfs_close__stdio in miniaudio.h. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.