Simple Directmedia Layer · Sdl · CVE-2019-13626
**Name of the Vulnerable Software and Affected Versions**
SDL (Simple DirectMedia Layer) versions 2.x through 2.0.9
**Description**
The issue is related to a heap-based buffer over-read in Fill IMA ADPCM block, caused by an integer overflow in the `IMA ADPCM decode()` function in audio/SDL wave.c. This can be exploited by a remote attacker using a specially crafted file, potentially leading to a denial of service.
**Recommendations**
For versions 2.x through 2.0.9, consider disabling the `IMA ADPCM decode()` function as a temporary workaround until a patch is available. Restrict access to the audio/SDL wave.c component to minimize the risk of exploitation. Avoid using the `Fill IMA ADPCM block` function in the affected SDL versions until the issue is resolved.