Description
dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mackron | dr_libs dr_wav.h | ≤ 0.14.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | qtads +3 | No fix yet | — |
| Ubuntu 26.04 LTS | qtads +3 | No fix yet | — |
| Ubuntu 26.04 LTS | roc-toolkit | 0.4.0+dfsg-5ubuntu3.1 | USN-8612-1 |
| Ubuntu 25.10 | qtads +4 | No fix yet | — |
| Ubuntu 24.04 LTS | qtads +3 | No fix yet | — |
| Ubuntu 22.04 LTS | qtads +2 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | qtads +2 | No fix yet | — |
| Ubuntu 18.04 LTS | qtads +1 | No fix yet | — |
| Ubuntu 16.04 LTS | qtads +1 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dr_libs | 20260901-1.1 | openSUSE-SU-2026:12176-1 |
Advisories 2
- openSUSE-SU-2026:12176-1 dr_libs-devel-20260901-1.1 on GA media SUSE / openSUSE Security Updates · Oct 19, 2026
- USN-8612-1 roc-toolkit vulnerability Ubuntu Security Notices (USN) · Jul 27, 2026
References
- https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2026-001-dr-libs-heap-overflow.md technical-description exploit
- https://github.com/mackron/dr_libs/issues/296 issue-tracking
- https://github.com/mackron/dr_libs/commit/8a7258cc66b49387ad58cc5b81568982a3560d49 patch
- https://www.vulncheck.com/advisories/mackron-dr-libs-heap-buffer-overflow-via-wav-file third-party-advisory