Every CVE Search/ Get API key

CVE-2026-122328

SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder

8.5 High

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.16%Unchanged since Nov 6, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.5

SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Record
CVE-2026-122328
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-05
EUVDEUVD-2026-117536 8.5

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Record
EUVD-2026-117536
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-7qqc-5rvj-wqqw 8.5

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw()...

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Record
GHSA-7qqc-5rvj-wqqw
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-05
NVD 8.5

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Record
CVE-2026-122328
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-05
OSV 8.5

SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Record
CVE-2026-122328
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-121
Updated
2026-11-07
OSVDEBIAN-CVE-2026-122328 7.8

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Record
DEBIAN-CVE-2026-122328
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-07
OSVUBUNTU-CVE-2026-122328 8.5

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Record
UBUNTU-CVE-2026-122328
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-07

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libsdl3-mixer
Debian:14
 All versions, plus listed versions
3.1.2+ds-13.1.2+git20260204~9ea9abe+ds-13.1.2+git20260305~d186a5f+ds-13.1~git20250829~b0503d2+ds-13.1~git20250910~d032535+ds-1
Show 39 moreShow less
3.1~git20251026~86c6b09+ds-13.1~git20251030~8c516fc+ds-13.1~git20251207~fb31486+ds-13.1~git20251230~3a1965b+ds-13.1~git20260101~3045b35+ds-13.1~git20260120~7b5b902+ds-13.2.0+ds-13.2.2+ds-13.2.4+ds-13~git20230717+dfsg-13~git20230806~139b748+dfsg-13~git20230810~ec99350+ds-13~git20230904~dc93c43+ds-13~git20230913~d7e4f19+ds-13~git20230921~5ce3f92+ds-13~git20230930~92f0574+ds-13~git20231205~1d30b08+ds-13~git20240101~de0f62a+ds-13~git20240115~9eae94f+ds-13~git20240121~3c8461d+ds-13~git20240319~12fb85e+ds-13~git20240508~c2fe2a6+ds-13~git20240730~623ef30+ds-13~git20240828~36b1c88+ds-13~git20240915~809804e+ds-13~git20240925~e32ba24+ds-13~git20241102~5e2a705+ds-13~git20250107~4870186+ds-13~git20250112~1bf7a79+ds-13~git20250123~723ad21+ds-13~git20250203~ebdd9cc+ds-13~git20250214~bc9c365+ds-13~git20250226~39d11cd+ds-13~git20250302~78a2035+ds-13~git20250404~68764f3+ds-13~git20250514~37b69a0+ds-13~git20250514~37b69a0+ds-23~git20250523~daf0503+ds-13~git20250610~30c1301+ds-1
 None known
libsdl2-mixer
Ubuntu:14.04:LTS
 All versions, plus listed versions
2.0.0+dfsg1-12.0.0+dfsg1-22.0.0+dfsg1-3
 None known
libsdl2-mixer
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.0+dfsg1-52.0.1+dfsg1-1
 None known
libsdl2-mixer
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.0.1+dfsg1-32.0.2+dfsg1-2
 None known
libsdl2-mixer
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.0.4+dfsg1-22.0.4+dfsg1-2build1
 None known
libsdl2-mixer
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.0.4+dfsg1-32.0.4+dfsg1-42.0.4+dfsg1-4build1
 None known
libsdl2-mixer
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.6.3+dfsg-12.8.0+dfsg-12.8.0+dfsg-1build12.8.0+dfsg-1build22.8.0+dfsg-1build3
 None known
libsdl2-mixer
Ubuntu:26.10
 All versions, plus listed versions
2.8.1+dfsg-52.8.2+dfsg-1
 None known
libsdl3-mixer
Ubuntu:26.10
 All versions, plus listed versions
3.2.2+ds-13.2.4+ds-1
 None known
libsdl2-mixer
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.8.1+dfsg-22.8.1+dfsg-42.8.1+dfsg-5
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesOSV
referencesEUVD, NVD, OSV
aliases, referencesGitHub Advisories
first indexedCVE List, EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-122328 is a high vulnerability (CVSS 8.5) in Libsdl-org Sdl Mixer, published November 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. No source names a fixed version.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open