Out-of-bounds read in UADE lets crafted short modules crash apps
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
UADE through 3.05 contains an out-of-bounds read in uade_filemagic() caused by an unsigned size subtraction that wraps on short inputs (CWE-125). A local attacker who gets a user to open a crafted short module can make the read run far past the buffer, crashing applications that probe or play it.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applications that probe or play it.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for UADE.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111164
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: LOW → MEDIUM
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences