Log in Start free

Vulnerability · Published Aug 5, 2026 · Assigned by TuranSec

CVE-2026-71261dr_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buffer Overflow on 32-bit Builds

High 7.8

In plain English

A high-severity integer overflow in dr_libs from mackron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 93.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:24.04:LTSlibchdrno fix listedUBUNTU-CVE-2026-71261
Ubuntu:26.04:LTSlibchdrno fix listedUBUNTU-CVE-2026-71261
Ubuntu:26.10libchdrno fix listedUBUNTU-CVE-2026-71261
Ubuntu:22.04:LTSqt6-multimediano fix listedUBUNTU-CVE-2026-71261
Ubuntu:24.04:LTSqt6-multimediano fix listedUBUNTU-CVE-2026-71261
Ubuntu:26.04:LTSqt6-multimediano fix listedUBUNTU-CVE-2026-71261
Ubuntu:26.10qt6-multimediano fix listedUBUNTU-CVE-2026-71261
Ubuntu:22.04:LTSqtadsno fix listedUBUNTU-CVE-2026-71261
Ubuntu:24.04:LTSqtadsno fix listedUBUNTU-CVE-2026-71261
Ubuntu:26.04:LTSqtadsno fix listedUBUNTU-CVE-2026-71261
Ubuntu:26.10qtadsno fix listedUBUNTU-CVE-2026-71261

Affected products (as reported)

VendorProductVersions
mackron dr_libs 0 – through *

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References