{"id":"CVE-2026-32837","summary":"mackron / miniaudio Out-of-Bounds Read in BEXT Coding History Parsing","details":"miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.","modified":"2026-08-12T15:32:26.962293Z","published":"2026-03-17T19:10:06.080Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-170"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32837.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32837.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32837"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/mackron-miniaudio-out-of-bounds-read-in-bext-coding-history-parsing"},{"type":"REPORT","url":"https://github.com/mackron/miniaudio/issues/1101"},{"type":"FIX","url":"https://github.com/mackron/dr_libs/commit/04e40d66a7ba1632f93ec1328d4b42ad986e3ee0"},{"type":"FIX","url":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde"},{"type":"PACKAGE","url":"https://github.com/mackron/miniaudio"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mackron/dr_libs","events":[{"introduced":"0"},{"fixed":"04e40d66a7ba1632f93ec1328d4b42ad986e3ee0"}],"database_specific":{"source":"REFERENCES"}},{"type":"GIT","repo":"https://github.com/mackron/miniaudio","events":[{"introduced":"0"},{"fixed":"1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde"}],"database_specific":{"cpe":"cpe:2.3:a:mackron:miniaudio:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"0.11.25"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["wav-0.14.5","mp3-0.7.3","wav-0.14.4","flac-0.13.3","wav-0.14.3","wav-0.14.2","mp3-0.7.2","flac-0.13.2","wav-0.14.1","flac-0.13.1","mp3-0.7.1","wav-0.14.0","mp3-0.7.0","flac-0.13.0","wav-0.13.17","mp3-0.6.40","flac-0.12.43","0.11.25","0.11.24","0.11.23","0.11.22","0.11.21","0.11.20","0.11.19","0.11.18","0.11.17","0.11.16","0.11.15"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32837.json","vanir_signatures_modified":"2026-08-12T15:32:26Z","vanir_signatures":[{"source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_wav__metadata_process_chunk"},"deprecated":false,"digest":{"function_hash":"68740539282378235448736197464329687364","length":8794},"id":"CVE-2026-32837-11a13c72","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_flac__seek_to_pcm_frame__binary_search_internal"},"deprecated":false,"digest":{"length":1787,"function_hash":"215916936038680883975386106498656468541"},"id":"CVE-2026-32837-25da526e"},{"digest":{"function_hash":"188912483529563539375994585730094931795","length":830},"id":"CVE-2026-32837-2ef77232","signature_type":"Function","signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_wav__pcm_to_f32"},"deprecated":false},{"target":{"file":"miniaudio.h","function":"ma_dr_wav__read_smpl_to_metadata_obj"},"deprecated":false,"digest":{"function_hash":"252958945724894409682966720291676995391","length":2567},"id":"CVE-2026-32837-517673ef","signature_type":"Function","signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde"},{"id":"CVE-2026-32837-5746ab02","signature_type":"Function","signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_mp3__full_read_and_close_s16"},"deprecated":false,"digest":{"function_hash":"101194492292128629680745204175165742789","length":1168}},{"source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_mp3__full_read_and_close_f32"},"deprecated":false,"digest":{"function_hash":"101194492292128629680745204175165742789","length":1168},"id":"CVE-2026-32837-57f16af8","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_wav__read_chunk_header"},"deprecated":false,"digest":{"function_hash":"215566583383861985526553710739644911550","length":910},"id":"CVE-2026-32837-6bd76b2e","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_mp3_init_internal"},"deprecated":false,"digest":{"length":6311,"function_hash":"128465750684540150957112266858967811974"},"id":"CVE-2026-32837-70a53380","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_flac__read_and_decode_metadata"},"deprecated":false,"digest":{"length":10642,"function_hash":"244400283984234237851516751409597227900"},"id":"CVE-2026-32837-7ef0da87","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-32837-81ac560d","signature_type":"Line","signature_version":"v1","source":"https://github.com/mackron/dr_libs/commit/04e40d66a7ba1632f93ec1328d4b42ad986e3ee0","target":{"file":"dr_wav.h"},"deprecated":false,"digest":{"line_hashes":["75331902515497510300610705167564788972","213864069237770781923711374017891281731","262060013769418571190546223575201366272","238512186141249962132771310701398940727","165115212910164745610985578653748848851","278240259285042136071991589731857097944","220938037336958148249211254130902286798","327708597962943320358071630195821231237","60799623647573406518182611942323593155","119763434519947992881935478934869808017"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"function":"ma_dr_wav__read_bext_to_metadata_obj","file":"miniaudio.h"},"deprecated":false,"digest":{"function_hash":"224675603668634189087211808518392287251","length":2580},"id":"CVE-2026-32837-9b952661"},{"id":"CVE-2026-32837-a165f4b7","signature_type":"Function","signature_version":"v1","source":"https://github.com/mackron/dr_libs/commit/04e40d66a7ba1632f93ec1328d4b42ad986e3ee0","target":{"file":"dr_wav.h","function":"drwav__read_bext_to_metadata_obj"},"deprecated":false,"digest":{"function_hash":"172490312644354067152343630816113108963","length":2527}},{"deprecated":false,"digest":{"line_hashes":["156795787947303449052969177408990759377","141419661303167427615897883497554907320","11407771528057744809405803805058737692","156795787947303449052969177408990759377","210141542460771396834585546146111188964","173114714564113221479267754777981282454","156795787947303449052969177408990759377","197182503734544545109986340670891564286","99357272242065514340523418171138250984","71905810252351707287787321726041934968","229776090783436448654828728183701419333","216152195258853321617478784590712008445","264271642273227327016781914603930287526","216194198067743006897437782423111034433","185086442592269957910289152110256003305","68384926574209124990957157580406814754","238063745532076325699063115400807811931","1048104556783380368568766814268175428","274557993652849148758141429123566639429","225642820603357974364421819444424980592","173312946142870966308799148015756664276","56856718259211090881108536122190617184","295256873307382544113332213235091727950","188134522881775639006102605421522360979","64539253930926581862044928390960188806","162139126119991599277792522946890477648","96098372908421112825348017051606773241","58450664191326420030381026614073956566","38668262523179058787201542542805167757","133086029401906904839974825795702921503","302066309391086746404115321638870597260","137473062277687131855933626122562922509","150988054713379878559474820287497058483","44369005812242189072277796348876902910","33195052054675371581669255406082753671","227551164481302186549371676330476349574","204920506132837892334228655212893250315","329769169739008168521918159950623411152","206534274737368250011127276971143727950","339051540865886879635987362271192374296","294556709203475025845081866887453551497","261539579631334770699581492336343103381","161620657529717636588521587436470868437","339051540865886879635987362271192374296","294556709203475025845081866887453551497","86043823394197261960179899920452679432","244081426415139549638800058678589763069","339051540865886879635987362271192374296","294556709203475025845081866887453551497","232188431606331892781663361493432963322","61801049656525861493159593412375798774","55656714534295307734427502696117972483","27984394316452761574263703716462835280","142693911158826151791735041304840868131","142772340235232863849072663692373632774","86850882485109552784944898908450973409","84554220024801620264357316806685987467","145992144050348534107929967912397838067","66271055394673689420479575236316948122","77605408132086908290550544469135394653","230673840254919438056351360903457630264","265583596197409742259939179336906784982","241629993655621792303365911721144545808","226349004335534441904716088151718018897","253203063526383212129071731897078609187","88270639829247998763141997963369236052","129659042824977538151522649810437718248","255981787844955546323123447362054730188","35372402919668016605905707031120522841","185614157368501841958952582306019821146","276596541074949081055904615153657264792","4847881200190529886993575456665583513","43062854649422008573971928635853824004","110378666986850686609715941402472347421","224768287864435169447500720621253906697","153453767315731798618888688923764390123","334583330722925138397028011353522909775","180512305484630660105845367698513677888","324492245290075172150530725285281487808","83854850565314035569582192717915132294","305351904994496842906852670004339581234","297015941264432611495592536835619405913","264122046991060135958074768807838543257","265378277774730444105585068611574844498","108728622203328714155660927793012438327","31879221662564285298129361631460085036","68476147814077043406722888148211230850","201008313671546030805248257731583673298","195908854238769574885364609844215415269","52880431107984347475444307464573650","310218586785793753360952553693237536167","79988626947779151124635975698380913062","151956542819820935062001410208788484104","160875838034720920375081616905333900821","264140366541011963976864472671635359826","335933828976610046719563620668562755253","296001994995493964553788538303157327565","1688906611421727691297715511728092725","294085047969993414718651795594106646520","92686251692444571601125601556958949439","84347194778445216101785047290936258325","231810115165519663070623535721399411711","55433131582539464930626343920353786920","223894584098009260988789564831469003631","150815495160009260843532861059074911051","251096986949217577681742210151508455939","170545353283505009664843220747986924369","238872186207607521410056143236598247320","307365942892891981421828006784412234079","333291389358151107494654714653855701453","197155663002124808382028778813169462711","177024200601483591071170911336529795311","177499068723068303184284888476226020918","93561269076110678668084086851612335845","199134499302240393360054631171619828467","89486706713801711977962723053719418126","258820451143758077748223001103912436304","309377564863190031904135384021621687899","210899361754263052448050621271057853530","5555567528076831037577234751045418788","30152539794424821934868639628202287420","185588900909905375381879718972704539472","9897198679744047076628866938661786858","35397904717656158466898001501428533839","118701389049885871588691134106627519722","93306011799935964617180512392883048882","260378445198078886786727672537477140794","298159172968649215466077119775956410996","280817939847258487403206496091612695914","259228508288845388879877808524404419164","280296374176817210079197876166955524046","241778387033947027916511032876700545806","303237997275654928975931217588279495587","82401450315979446080526893460548038967","22945832634496829644512014742550382277","131245478691863183240804499883652283180","225959437045802725103830580544061254490","208671584943073334167278998885214329746","264347041600734690453482839950972716735","114732501480354417315611481383157138039","285669756901705627221472303795822937255","73967073793382726489529559801083281183","34288355358264039782439614592741186345","172581523777171434576808549979131145353","269856975859467623809027508076665255784","99320275881309858412610233395400764686","183455404470646133284767200289174695255","293135976527019955018431332334604213843","231168693809067654804024545056230069966","111782256486646138047148380604117676","257150508685331546771169364579495895135","314428552583571166205574244442118720505","37644698135911176302766125240989401438","99539766417530972188664162549287582514","71711448251374412226282963090725483462","244253792912668380464888835458842381480","118442132250424325521920380203318146748","235262983709483128645285653223491821990","119616314531377362361269517921002376249","236568338718830657315082935247658844676","246296719835452432276128664771074117131","187803239905253126080793144027951266579","115529163574252360002190633383859501996","56077022089391231499295916949101747491","284209986880824339426399198810772498936","36725782109712502764995259784240787439","1065714635162166310640821053776299940","230373423882978196781119463496494071044","150203700137933613269777540137361625548","20742834199292810533950173261144069717","68325779105070840431450875291497235020","139090914289421356871000879565731054557","164950736488504337008708048304528397036","313508218489527092054623993392043217101","319284798327792483404017492618454243262","126297450485197815773988390304472077992","217589861131262676659951221956114568873"],"threshold":0.9},"id":"CVE-2026-32837-b201bc3c","signature_type":"Line","signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h"}},{"signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_flac_open_with_metadata_private"},"deprecated":false,"digest":{"function_hash":"75692032195145091718144805929960777526","length":4804},"id":"CVE-2026-32837-b984edd4","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"263229805842504126809509328171199097716","length":16687},"id":"CVE-2026-32837-cf7b8573","signature_type":"Function","signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_wav_init__internal"}},{"id":"CVE-2026-32837-d0b8ad0b","signature_type":"Function","signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_mp3_read_pcm_frames_f32"},"deprecated":false,"digest":{"function_hash":"72621988515577566839537940079860476685","length":915}},{"deprecated":false,"digest":{"function_hash":"154389684596819775323870349498602488804","length":851},"id":"CVE-2026-32837-d2d1aaa8","signature_type":"Function","signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_wav__pcm_to_s32"}},{"signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"function":"ma_dr_mp3_read_pcm_frames_s16","file":"miniaudio.h"},"deprecated":false,"digest":{"function_hash":"135371906402038154958269751331255992240","length":913},"id":"CVE-2026-32837-e36859a7","signature_type":"Function"},{"digest":{"function_hash":"646145887471522308075005652160598209","length":842},"id":"CVE-2026-32837-eb64bfe3","signature_type":"Function","signature_version":"v1","source":"https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde","target":{"file":"miniaudio.h","function":"ma_dr_wav__pcm_to_s16"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}