Log in Start free

Vulnerability · Published Mar 3, 2026 · Assigned by VulnCheck

CVE-2026-29022mackron / dr_libs dr_wav.h Heap Buffer Overflow via WAV File

High 7.3

In plain English

A high-severity heap buffer overflow in dr_libs dr_wav.h from mackron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.2%top 83.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:24.04:LTSdosbox-xno fix listedUBUNTU-CVE-2026-29022
Ubuntu:25.10dosbox-xno fix listedUBUNTU-CVE-2026-29022
Ubuntu:26.04:LTSdosbox-xno fix listedUBUNTU-CVE-2026-29022
Ubuntu:26.10dosbox-xno fix listedUBUNTU-CVE-2026-29022
Ubuntu:22.04:LTSfaudiono fix listedUBUNTU-CVE-2026-29022
Ubuntu:24.04:LTSfaudiono fix listedUBUNTU-CVE-2026-29022
Ubuntu:25.10faudiono fix listedUBUNTU-CVE-2026-29022
Ubuntu:26.04:LTSfaudiono fix listedUBUNTU-CVE-2026-29022
Ubuntu:26.10faudiono fix listedUBUNTU-CVE-2026-29022
Ubuntu:22.04:LTSoctave-ltfatno fix listedUBUNTU-CVE-2026-29022
Ubuntu:24.04:LTSoctave-ltfatno fix listedUBUNTU-CVE-2026-29022
Ubuntu:25.10octave-ltfatno fix listedUBUNTU-CVE-2026-29022
Ubuntu:26.04:LTSoctave-ltfatno fix listedUBUNTU-CVE-2026-29022
Ubuntu:26.10octave-ltfatno fix listedUBUNTU-CVE-2026-29022
Ubuntu:22.04:LTSqtadsno fix listedUBUNTU-CVE-2026-29022
Ubuntu:24.04:LTSqtadsno fix listedUBUNTU-CVE-2026-29022
Ubuntu:25.10qtadsno fix listedUBUNTU-CVE-2026-29022
Ubuntu:26.04:LTSqtadsno fix listedUBUNTU-CVE-2026-29022
Ubuntu:26.10qtadsno fix listedUBUNTU-CVE-2026-29022
Ubuntu:25.10roc-toolkitno fix listedUBUNTU-CVE-2026-29022
Ubuntu:26.04:LTSroc-toolkit0.4.0+dfsg-5ubuntu3.1UBUNTU-CVE-2026-29022
Ubuntu:26.04:LTSroc-toolkit0.4.0+dfsg-5ubuntu3.1USN-8612-1

Affected products (as reported)

VendorProductVersions
mackron dr_libs dr_wav.h 0 – through 0.14.4

Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

References