CVE-2026-71261
dr_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buffer Overflow on 32-bit Builds
dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
dr_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buffer Overflow on 32-bit Builds
dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.
- Record
CVE-2026-71261- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-53346
dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.
- Record
EUVD-2026-53346- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cfw7-vmp5-wg69
dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE...
dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk(), a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly. The subsequent read in drwav__read_cue_to_metadata_obj() computes the actual cue point count and allocation size using the full-precision, attacker-controlled cuePointCount field without cross-checking it against the stage-1 capacity estimate, and the only bounds enforcement on the resulting memory region (drwav__metadata_get_memory()) is a DRWAV_ASSERT, which compiles to a no-op under -DNDEBUG (the default for release builds). A crafted W64 WAV file can therefore cause a heap buffer overflow in any 32-bit application parsing untrusted WAV metadata.
- Record
GHSA-cfw7-vmp5-wg69- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.
- Record
CVE-2026-71261- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-71261
dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.
- Record
UBUNTU-CVE-2026-71261- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qtadsUbuntu:16.04:LTS |
All versions, plus listed versions 2.1.6-1 |
None known |
qtadsUbuntu:18.04:LTS |
All versions, plus listed versions 2.1.6-1.1 |
None known |
qtadsUbuntu:20.04:LTS |
All versions, plus listed versions 2.1.6-1.12.1.7-0.12.1.7-0.1build1 |
None known |
qt6-multimediaUbuntu:22.04:LTS |
All versions, plus listed versions 6.2.2-36.2.4-1 |
None known |
qtadsUbuntu:22.04:LTS |
All versions, plus listed versions 2.1.7-0.1build1 |
None known |
libchdrUbuntu:24.04:LTS |
All versions, plus listed versions 0.0~git20230918.9108f34+dfsg-2 |
None known |
qt6-multimediaUbuntu:24.04:LTS |
All versions, plus listed versions 6.4.2-10build16.4.2-116.4.2-11build26.4.2-11build3 |
None known |
qtadsUbuntu:24.04:LTS |
All versions, plus listed versions 3.4.0+dfsg-13.4.0+dfsg-1build13.4.0+dfsg-1build23.4.0+dfsg-1build3 |
None known |
libchdrUbuntu:26.10 |
All versions, plus listed versions 0.0~git20250608.8bba774+dfsg-20.3.0+dfsg-1 |
None known |
qt6-multimediaUbuntu:26.10 |
All versions, plus listed versions 6.10.2-26.10.2-46.10.2-56.10.2-66.11.2-2 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qtadsUbuntu:26.10 |
All versions, plus listed versions 3.4.0+dfsg-2 |
None known |
libchdrUbuntu:26.04:LTS |
All versions, plus listed versions 0.0~git20240929.aaca599+dfsg-10.0~git20250608.8bba774+dfsg-10.0~git20250608.8bba774+dfsg-2 |
None known |
qt6-multimediaUbuntu:26.04:LTS |
All versions, plus listed versions 6.9.2-1ubuntu16.9.2-46.9.2-56.9.2-5build16.10.2-2 |
None known |
qtadsUbuntu:26.04:LTS |
All versions, plus listed versions 3.4.0+dfsg-1build33.4.0+dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-71261 is a high vulnerability (CVSS 7.8) in Mackron Dr Libs, published August 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.