PT-2026-25931 · Dr Libs · Dr Libs

Ana Kapulica · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-32836

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions dr libs versions 0.13.3 and earlier

Description The software contains an uncontrolled memory allocation issue in the drflac read and decode metadata() function. This allows attackers to cause a denial of service by triggering excessive memory allocation. The issue is related to crafted PICTURE metadata blocks, specifically through manipulating the mimeLength and descriptionLength fields. Exploitation leads to memory exhaustion when processing FLAC streams with metadata callbacks.

Recommendations Update dr libs to a version later than 0.13.3.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-32836

Affected Products

Dr Libs

References · 11

• https://github.com/mackron/dr_libs/commit/fefced4a64adfb1a68a2d31d882366e56096dee8 · Patch
• https://github.com/mackron/dr_libs/commit/4f5a4cd3b57564d969443c580c75857e039f100a · Patch
• https://github.com/mackron/dr_libs/commit/663239a3d0460c33bd5b6e5166edcb404e3df676 · Patch
• https://github.com/mackron/dr_libs/issues/298 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32836 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32836 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32836 · Security Note
• https://twitter.com/VulmonFeeds/status/2034030097745817742 · Twitter Post
• https://vulncheck.com/advisories/mackron-dr-libs-excessive-memory-allocation-in-picture-metadata-parsing · Note
• https://twitter.com/CVEnew/status/2033994234714591328 · Twitter Post