PT-2026-25931 · Dr Libs · Dr Libs

Ana Kapulica · Publicado 2026-03-17 · Atualizado 2026-03-17 · CVE-2026-32836

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions dr libs versions 0.13.3 and earlier

Description The software contains an uncontrolled memory allocation issue in the drflac read and decode metadata() function. This allows attackers to cause a denial of service by triggering excessive memory allocation. The issue is related to crafted PICTURE metadata blocks, specifically through manipulating the mimeLength and descriptionLength fields. Exploitation leads to memory exhaustion when processing FLAC streams with metadata callbacks.

Recommendations Update dr libs to a version later than 0.13.3.

Correção

Enumeração de Fraquezas

CWE-789

Identificadores relacionados

CVE-2026-32836

Produtos afetados

Dr Libs

Referências · 11

• https://github.com/mackron/dr_libs/commit/fefced4a64adfb1a68a2d31d882366e56096dee8 · Correção
• https://github.com/mackron/dr_libs/commit/4f5a4cd3b57564d969443c580c75857e039f100a · Correção
• https://github.com/mackron/dr_libs/commit/663239a3d0460c33bd5b6e5166edcb404e3df676 · Correção
• https://github.com/mackron/dr_libs/issues/298 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-32836 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-32836 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034030097745817742 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32836 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32836 · Nota de Segurança
• https://vulncheck.com/advisories/mackron-dr-libs-excessive-memory-allocation-in-picture-metadata-parsing · Nota
• https://twitter.com/CVEnew/status/2033994234714591328 · Publicação no Twitter