CVE-2026-32837 Details
Description
miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.
A heap out-of-bounds read vulnerability has been identified in Miniaudio versions through 0.11.25. This vulnerability resides in the WAV BEXT metadata parser, where improper handling of null termination in the coding history field allows attackers to craft WAV files that trigger memory access violations. Exploitation of this vulnerability can lead to application crashes or a denial-of-service condition.
Users are advised to update to Miniaudio version 0.11.26 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-170 | Improper Null Termination | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mackron miniaudio | <= 0.11.25 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | CVE Modified | [email protected] |
| Mar 19, 2026 | Initial Analysis | [email protected] |
| Mar 17, 2026 | New CVE Received | [email protected] |