CVE-2026-32836

mackron / dr_libs dr_flac.h Excessive Memory Allocation in PICTURE Metadata Parsing

6.9 Medium

dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vulnerability in drflac__read_and_decode_metadata() that allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can exploit attacker-controlled mimeLength and descriptionLength fields to cause denial of service through memory exhaustion when processing FLAC streams with metadata callbacks.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.19%Up 0.2 points since Mar 18, 2026

What each source reports

CVE List Score used 6.9

mackron / dr_libs dr_flac.h Excessive Memory Allocation in PICTURE Metadata Parsing

Record: CVE-2026-32836
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-789
Updated: 2026-11-02

EUVDEUVD-2026-12631 6.9

Record: EUVD-2026-12631
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6mgc-4427-8p4x 6.9

dr_libs version 0.13.3 and earlier contain an uncontrolled memory allocation vulnerability in...

dr_libs version 0.13.3 and earlier contain an uncontrolled memory allocation vulnerability in drflac__read_and_decode_metadata() that allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can exploit attacker-controlled mimeLength and descriptionLength fields to cause denial of service through memory exhaustion when processing FLAC streams with metadata callbacks.

Record: GHSA-6mgc-4427-8p4x
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-789
Updated: 2026-11-02

NVD 6.9

Record: CVE-2026-32836
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-789
Updated: 2026-11-02

OSV 6.9

mackron / dr_libs dr_flac.h Excessive Memory Allocation in PICTURE Metadata Parsing

Record: CVE-2026-32836
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-789
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-32836 6.9

Record: DEBIAN-CVE-2026-32836
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-32836 6.9

Record: UBUNTU-CVE-2026-32836
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2026:12176-1 No score

dr_libs-devel-20260901-1.1 on GA media

These are all security issues fixed in the dr_libs-devel-20260901-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:12176-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libchdr` Debian:13	All versions, plus listed versions 0.0~git20240929.aaca599+dfsg-10.0~git20250608.8bba774+dfsg-10.0~git20250608.8bba774+dfsg-20.0~git20250608.8bba774+dfsg-30.3.0+dfsg-1	None known
`libchdr` Debian:14	All versions, plus listed versions 0.0~git20240929.aaca599+dfsg-10.0~git20250608.8bba774+dfsg-10.0~git20250608.8bba774+dfsg-20.0~git20250608.8bba774+dfsg-30.3.0+dfsg-1	None known
`libchdr` Ubuntu:24.04:LTS	All versions, plus listed versions 0.0~git20230918.9108f34+dfsg-2	None known
`libchdr` Ubuntu:25.10	All versions, plus listed versions 0.0~git20240929.aaca599+dfsg-1	None known
`libchdr` Ubuntu:26.10	All versions, plus listed versions 0.0~git20250608.8bba774+dfsg-20.3.0+dfsg-1	None known
`libchdr` Ubuntu:26.04:LTS	All versions, plus listed versions 0.0~git20240929.aaca599+dfsg-10.0~git20250608.8bba774+dfsg-10.0~git20250608.8bba774+dfsg-2	None known
`dr_libs` openSUSE:Tumbleweed From an advisory covering 2 CVEs	before 20260901-1.1	20260901-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-32836 is a medium vulnerability (CVSS 6.9) in Mackron Dr Libs, published March 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. No source names a fixed version.

References

Show 8 moreShow less