Sdl · Simple Directmedia Layer · CVE-2019-7574
**Name of the Vulnerable Software and Affected Versions**
Simple DirectMedia Layer versions 1.2.15 and earlier
Simple DirectMedia Layer versions 2.x through 2.0.9
**Description**
The issue is related to a heap-based buffer over-read in the `IMA ADPCM decode` function, located in `audio/SDL wave.c`, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information.
**Recommendations**
For Simple DirectMedia Layer versions 1.2.15 and earlier, update to a version later than 1.2.15.
For Simple DirectMedia Layer versions 2.x through 2.0.9, update to a version later than 2.0.9.
As a temporary workaround, consider disabling the `IMA ADPCM decode` function until a patch is available.