CVE-2026-32836

Katalog CVE

CVSS 6.2 · Medium EPSS 0,18%

Kerentanan Memory Allocation with Excessive Size Value pada mackron dr libs. Skor CVSS 3.1 6.2 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vulnerability in drflac__read_and_decode_metadata() that allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can exploit attacker-controlled mimeLength and descriptionLength fields to cause denial of service through memory exhaustion when processing FLAC streams with metadata callbacks.

Rincian

Terbit di NVD

17 Maret 2026

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

6.2 (Medium), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-789: Memory Allocation with Excessive Size Value

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mackron/dr_libs/issues/298 exploit · issue tracking · mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/mackron-dr-libs-excessive-memory-allocation-in-picture-metadata-parsing advisory pihak ketiga
• https://github.com/mackron/dr_libs/commit/4f5a4cd3b57564d969443c580c75857e039f100a
• https://github.com/mackron/dr_libs/commit/663239a3d0460c33bd5b6e5166edcb404e3df676
• https://github.com/mackron/dr_libs/commit/fefced4a64adfb1a68a2d31d882366e56096dee8