CVE-2026-29022
mackron / dr_libs dr_wav.h Heap Buffer Overflow via WAV File
dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
mackron / dr_libs dr_wav.h Heap Buffer Overflow via WAV File
dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.
- Record
CVE-2026-29022- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2026-9315
dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.
- Record
EUVD-2026-9315- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-38j9-4vcr-j8qh
dr_libs version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow...
dr_libs version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.
- Record
GHSA-38j9-4vcr-j8qh- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-122, CWE-787
- Updated
- 2026-11-02
NVD
dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.
- Record
CVE-2026-29022- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122, CWE-787
- Updated
- 2026-11-02
OSV
mackron / dr_libs dr_wav.h Heap Buffer Overflow via WAV File
dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.
- Record
CVE-2026-29022- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-29022
dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.
- Record
UBUNTU-CVE-2026-29022- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12176-1 No score
dr_libs-devel-20260901-1.1 on GA media
These are all security issues fixed in the dr_libs-devel-20260901-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12176-1- Updated
- 2026-11-02
OSVUSN-8612-1 No score
roc-toolkit vulnerability
It was discovered that Roc Toolkit incorrectly handled WAV files with a malformed "smpl" chunk. An attacker could use this issue to cause Roc Toolkit to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-8612-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
octave-ltfatUbuntu:16.04:LTS |
All versions, plus listed versions 2.1.0+dfsg-12.1.1+dfsg-12.1.1+dfsg-2 |
None known |
qtadsUbuntu:16.04:LTS |
All versions, plus listed versions 2.1.6-1 |
None known |
octave-ltfatUbuntu:18.04:LTS |
All versions, plus listed versions 2.2.0+dfsg-42.2.0+dfsg-52.2.0+dfsg-7 |
None known |
qtadsUbuntu:18.04:LTS |
All versions, plus listed versions 2.1.6-1.1 |
None known |
faudioUbuntu:20.04:LTS |
All versions, plus listed versions 19.07-119.11-119.12-120.04-2 |
None known |
octave-ltfatUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.1+dfsg-22.3.1+dfsg-2build12.3.1+dfsg-32.3.1+dfsg-3build1 |
None known |
qtadsUbuntu:20.04:LTS |
All versions, plus listed versions 2.1.6-1.12.1.7-0.12.1.7-0.1build1 |
None known |
faudioUbuntu:22.04:LTS |
All versions, plus listed versions 21.02-121.11-121.12-122.01-122.02-1 |
None known |
octave-ltfatUbuntu:22.04:LTS |
All versions, plus listed versions 2.3.1+dfsg-82.3.1+dfsg-102.3.1+dfsg-10build1 |
None known |
qtadsUbuntu:22.04:LTS |
All versions, plus listed versions 2.1.7-0.1build1 |
None known |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dosbox-xUbuntu:24.04:LTS |
All versions, plus listed versions 2023.10.06+dfsg-12024.03.01+dfsg-1build12024.03.01+dfsg-1build2 |
None known |
faudioUbuntu:24.04:LTS |
All versions, plus listed versions 23.07+dfsg-123.08+dfsg-123.11+dfsg-124.02+dfsg-124.02+dfsg-1build124.02+dfsg-1build2 |
None known |
octave-ltfatUbuntu:24.04:LTS |
All versions, plus listed versions 2.5.0+dfsg-2ubuntu12.6.0+dfsg-6ubuntu1 |
None known |
qtadsUbuntu:24.04:LTS |
All versions, plus listed versions 3.4.0+dfsg-13.4.0+dfsg-1build13.4.0+dfsg-1build23.4.0+dfsg-1build3 |
None known |
dosbox-xUbuntu:25.10 |
All versions, plus listed versions 2025.02.01+dfsg-12025.02.01+dfsg-3 |
None known |
faudioUbuntu:25.10 |
All versions, plus listed versions 25.03+dfsg-225.04+dfsg-125.05+dfsg-1 |
None known |
octave-ltfatUbuntu:25.10 |
All versions, plus listed versions 2.6.0+dfsg-6ubuntu2 |
None known |
qtadsUbuntu:25.10 |
All versions, plus listed versions 3.4.0+dfsg-1build3 |
None known |
roc-toolkitUbuntu:25.10 |
All versions, plus listed versions 0.4.0+dfsg-4ubuntu10.4.0+dfsg-5ubuntu1 |
None known |
dosbox-xUbuntu:26.10 |
All versions, plus listed versions 2026.01.02+dfsg-22026.06.02+dfsg-12026.07.02+dfsg-12026.08.02+dfsg-12026.08.02+dfsg-2 |
None known |
faudioUbuntu:26.10 |
All versions, plus listed versions 26.01+dfsg-126.05+dfsg-126.06+dfsg-126.07+dfsg-1 |
None known |
octave-ltfatUbuntu:26.10 |
All versions, plus listed versions 2.6.0+dfsg-7build1 |
None known |
qtadsUbuntu:26.10 |
All versions, plus listed versions 3.4.0+dfsg-2 |
None known |
dosbox-xUbuntu:26.04:LTS |
All versions, plus listed versions 2025.02.01+dfsg-32025.10.07+dfsg-12025.12.01+dfsg-12026.01.02+dfsg-12026.01.02+dfsg-2 |
None known |
faudioUbuntu:26.04:LTS |
All versions, plus listed versions 25.05+dfsg-125.09+dfsg-125.12+dfsg-125.12+dfsg-226.01+dfsg-1 |
None known |
octave-ltfatUbuntu:26.04:LTS |
All versions, plus listed versions 2.6.0+dfsg-6ubuntu22.6.0+dfsg-72.6.0+dfsg-7build1 |
None known |
qtadsUbuntu:26.04:LTS |
All versions, plus listed versions 3.4.0+dfsg-1build33.4.0+dfsg-2 |
None known |
roc-toolkitUbuntu:26.04:LTS |
before 0.4.0+dfsg-5ubuntu3.1, plus listed versions 0.4.0+dfsg-5ubuntu10.4.0+dfsg-5ubuntu3 |
0.4.0+dfsg-5ubuntu3.1 |
dr_libsopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 20260901-1.1 | 20260901-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-29022 is a medium vulnerability (CVSS 6.8) in Mackron Dr Libs, published March 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in roc-toolkit 0.4.0+dfsg-5ubuntu3.1.
References
github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2026-001-dr-libs-heap-overflow.md
vulncheck.com/advisories/mackron-dr-libs-heap-buffer-overflow-via-wav-file
nvd.nist.gov/vuln/detail/CVE-2026-29022