{"id":"UBUNTU-CVE-2026-71261","details":"dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.","modified":"2026-08-13T00:14:08Z","published":"2026-08-05T13:24:00Z","upstream":["CVE-2026-71261"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-71261"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-71261"},{"type":"REPORT","url":"https://github.com/mackron/dr_libs"},{"type":"REPORT","url":"https://github.com/mackron/dr_libs/blob/master/dr_wav.h"}],"affected":[{"package":{"name":"qtads","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/qtads?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.6-1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.1.6-1","binary_name":"qtads"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71261.json"}},{"package":{"name":"qtads","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/qtads?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.6-1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"qtads","binary_version":"2.1.6-1.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71261.json"}},{"package":{"name":"qtads","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/qtads?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.6-1.1","2.1.7-0.1","2.1.7-0.1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"qtads","binary_version":"2.1.7-0.1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71261.json"}},{"package":{"name":"qt6-multimedia","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/qt6-multimedia?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.2-3","6.2.4-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libqt6multimedia6","binary_version":"6.2.4-1"},{"binary_version":"6.2.4-1","binary_name":"libqt6multimediaquick6"},{"binary_name":"libqt6multimediawidgets6","binary_version":"6.2.4-1"},{"binary_name":"qml6-module-qtmultimedia","binary_version":"6.2.4-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71261.json"}},{"package":{"name":"qtads","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/qtads?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.7-0.1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"qtads","binary_version":"2.1.7-0.1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71261.json"}},{"package":{"name":"libchdr","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libchdr?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20230918.9108f34+dfsg-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libchdr0","binary_version":"0.0~git20230918.9108f34+dfsg-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71261.json"}},{"package":{"name":"qt6-multimedia","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/qt6-multimedia?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-10build1","6.4.2-11","6.4.2-11build2","6.4.2-11build3"],"ecosystem_specific":{"binaries":[{"binary_version":"6.4.2-11build3","binary_name":"libqt6multimedia6"},{"binary_name":"libqt6multimediaquick6","binary_version":"6.4.2-11build3"},{"binary_name":"libqt6multimediawidgets6","binary_version":"6.4.2-11build3"},{"binary_name":"libqt6spatialaudio6","binary_version":"6.4.2-11build3"},{"binary_version":"6.4.2-11build3","binary_name":"qml6-module-qtmultimedia"},{"binary_name":"qml6-module-qtquick3d-spatialaudio","binary_version":"6.4.2-11build3"},{"binary_version":"6.4.2-11build3","binary_name":"qt6-multimedia-doc-html"},{"binary_version":"6.4.2-11build3","binary_name":"qt6-multimedia-examples"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71261.json"}},{"package":{"name":"qtads","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/qtads?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0+dfsg-1","3.4.0+dfsg-1build1","3.4.0+dfsg-1build2","3.4.0+dfsg-1build3"],"ecosystem_specific":{"binaries":[{"binary_name":"qtads","binary_version":"3.4.0+dfsg-1build3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71261.json"}},{"package":{"name":"libchdr","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libchdr?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20240929.aaca599+dfsg-1","0.0~git20250608.8bba774+dfsg-1","0.0~git20250608.8bba774+dfsg-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libchdr0","binary_version":"0.0~git20250608.8bba774+dfsg-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71261.json"}},{"package":{"name":"qt6-multimedia","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/qt6-multimedia?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.2-1ubuntu1","6.9.2-4","6.9.2-5","6.9.2-5build1","6.10.2-2"],"ecosystem_specific":{"binaries":[{"binary_version":"6.10.2-2","binary_name":"libqt6multimedia6"},{"binary_name":"libqt6multimediawidgets6","binary_version":"6.10.2-2"},{"binary_name":"libqt6spatialaudio6","binary_version":"6.10.2-2"},{"binary_name":"qml6-module-qtmultimedia","binary_version":"6.10.2-2"},{"binary_name":"qml6-module-qtquick3d-spatialaudio","binary_version":"6.10.2-2"},{"binary_version":"6.10.2-2","binary_name":"qt6-multimedia-doc-html"},{"binary_version":"6.10.2-2","binary_name":"qt6-multimedia-examples"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71261.json"}},{"package":{"name":"qtads","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/qtads?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0+dfsg-1build3","3.4.0+dfsg-2"],"ecosystem_specific":{"binaries":[{"binary_name":"qtads","binary_version":"3.4.0+dfsg-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71261.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}