Stack buffer overflow in ReadyMedia via crafted DFF audio files
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow (CWE-121). A PROP chunk size in a crafted DFF audio file is used without validation to size a stack array, so file data overflows the stack. A remote attacker can place the file in a monitored directory to trigger parsing via inotify, which leads to remote code execution on unprotected builds or denial of service on hardened builds. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ReadyMedia | ReadyMedia (MiniDLNA) | 1.3.0 – 1.3.3 | — | No fix listed | CNA |
- ReadyMedia (MiniDLNA) VendorReadyMedia Affected 1.3.0 – 1.3.3 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for ReadyMedia (MiniDLNA).
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Vendor assessments
Timeline
- 2026-11-02 Threatist record created from CVE-2026-29508
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: MEDIUM → HIGH
- 2026-11-02 Alias added: GHSA-3p4r-mwmm-qcvg
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-03 CVSS score added · Red Hat
References
Sources
- CVE-2026-29508 · CVE Program
- CVE-2026-29508 · NVD
- FIRST EPSS
- GHSA-3p4r-mwmm-qcvg · GitHub Advisory Database · CC BY 4.0
- CVE-2026-29508 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences