Read the docs
TI-2026-25300 Aliases CVE-2026-32837GHSA-grfx-q7pf-j7ff

mackron / miniaudio Out-of-Bounds Read in BEXT Coding History Parsing

Priority MEDIUM 56CWE-170Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mackronminiaudioup to 0.11.25—Patch availableCNA
  • miniaudio Vendormackron Affected up to 0.11.25 Fixed in — Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mackron:miniaudio:*:*:*:*:*:*:*:*up to 0.11.25Vulnerablemackron
  • cpe:2.3:a:mackron:miniaudio:*:*:*:*:*:*:*:* Versions up to 0.11.25 Vulnerable ·mackron

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32837
  2. 2026-10-03 Alias added: GHSA-grfx-q7pf-j7ff

References

Exploit 1

Patch 2

  • TI-2024-27497 Heap-based buffer overflow in Miniaudio CVSS 3.1CRITICAL 9.8
  • TI-2021-13302 Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in… CVSS 3.1CRITICAL 9.8
  • TI-2021-13303 Miniaudio 0.10.35 has an integer-based buffer overflow caused by an out-of-bounds left… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences