PT-2026-25931 · Mackron · Dr Libs

Ana Kapulica · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-32836

NVD

CVSS v4.0

6.9

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

dr libs version 0.13.3 and earlier contain an uncontrolled memory allocation vulnerability in drflac read and decode metadata() that allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can exploit attacker-controlled mimeLength and descriptionLength fields to cause denial of service through memory exhaustion when processing FLAC streams with metadata callbacks.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-32836

Affected Products

Dr Libs

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-32836 · Security Note
• https://github.com/mackron/dr_libs/issues/298 · Note
• https://vulncheck.com/advisories/mackron-dr-libs-excessive-memory-allocation-in-picture-metadata-parsing · Note