CVE-2026-71261 Details

A heap buffer overflow vulnerability has been identified in the dr_libs audio processing library, specifically within the WAV metadata parsing component of the dr_wav header file. This issue affects all versions of the library up to the current master release. The vulnerability arises from an integer overflow during the processing of W64 CUE chunk metadata. In the function drwav__metadata_process_chunk(), the library incorrectly truncates the 64-bit W64 chunk size when estimating metadata capacity, particularly in 32-bit builds. This miscalculation allows for an attacker to manipulate the cue point count and allocation size, leading to a heap buffer overflow when the library reads CUE points from the metadata. The vulnerability can be exploited by crafting a W64 WAV file that exploits this flaw, causing the library to overwrite adjacent memory on the heap.