{"id":"CVE-2026-111164","summary":"UADE through 3.05 Out-of-Bounds Read in uade_filemagic via Short Module","details":"UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applications that probe or play it.","modified":"2026-10-17T02:48:20.934843592Z","published":"2026-10-15T18:57:51.235Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111164.json"},"references":[{"type":"WEB","url":"https://gitlab.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111164.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111164"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/uade-through-3.05-out-of-bounds-read-in-uade-filemagic-via-short-module"},{"type":"PACKAGE","url":"https://gitlab.com/uade-music-player/uade"},{"type":"ARTICLE","url":"https://gitlab.com/uade-music-player/uade/-/blob/659d2fb2dda66bb16ae43b46147135759f993d8e/src/frontends/common/amifilemagic.c#L1069-1078"},{"type":"ARTICLE","url":"https://hackmd.io/@haind-pwn/uade-amifilemagic-bufsize-underflow-oob-read"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/uade-music-player/uade","events":[{"introduced":"0"},{"fixed":"659d2fb2dda66bb16ae43b46147135759f993d8e"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"last_affected":"3.05"},{"fixed":"3.05"}]}}],"versions":["uade-3.04","uade-3.03","uade-3.02","uade-3.01","uade-3.00","uade-2.13","uade-2.12","uade-2.11","uade-2.10","uade-2.09","uade-2.08","uade-2.07","musicline-4v-v1","uade-2.06","uade-2.05","uade-2.04","uade-2.03","uade-2.02","uade-2.01","uade-2.00"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111164.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}