CVE-2025-14369

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-14369
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14369.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-14369
Downstream
Published
2026-01-20T11:49:08Z
Modified
2026-08-12T14:52:29Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
CVE-2025-14369
Details

dr_flac, an audio decoder within the dr_libs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool.

Database specific 
{
    "cna_assigner": "certcc",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14369.json"
}
References

Affected packages

Git / github.com/mackron/dr_libs

Affected ranges

Type
GIT
Repo
https://github.com/mackron/dr_libs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b2197b2eb7bb609df76315bebf44db4ec2a1aed0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.13.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

flac-0.*
flac-0.12.43
flac-0.13.0
flac-0.13.1
mp3-0.*
mp3-0.6.40
mp3-0.7.0
mp3-0.7.1
wav-0.*
wav-0.13.17
wav-0.14.0
wav-0.14.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14369.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "2272873539217649677311847914500477688",
                "325117956489813526796112203582791158344",
                "43694044640238617989751435236088567275",
                "297651770317242392417755929133067287574",
                "235195634800161156325365220327627169382",
                "182680987940512345278202053112027542389",
                "124533198011352049063649952199865837098",
                "331281813269733634677331258338017006841",
                "177534819893253267519082244332326403667",
                "155791506325620513655771864970720288020",
                "121896918977067299092091878011031263381",
                "34784166802446800873967821288268711738",
                "337088495695583812749374166449359908483",
                "146752017869043380297229598094066669167",
                "292705518095718228072737507760754546550",
                "155460187545943274712565147469360699804",
                "88558105475085065525237850959590493469",
                "268639650005652078250200277974510128645",
                "293857144800235952099124423926971661345",
                "108468649351246958639474159688074123271",
                "51664760018238681666754537402577283944",
                "35372958160664278267313253186753227032",
                "298858295611797470100512304394869700057",
                "306827683592183885311935728583992260891",
                "97885317416914990033755801757790751605",
                "180421216668384554429816208221893164863",
                "201839718581014266974372918935973018441",
                "281219075999401268610480336299353243868",
                "211955567581794094215406735173077328416",
                "237501853708181614074656016701963534036",
                "270176129213516254750623467919024546248",
                "110347863701324350235365632333800399079",
                "334679514769121965532558455804210404890",
                "112405302124459136712467173944277489648",
                "175573371971889598533784205682623549039",
                "42086258332877092945370045502913679996",
                "241411806194250511193344795586879714655",
                "264235606536066860687182487175079151038",
                "158180504020793237368528907193792783884",
                "305189022041883118383585898352594603454",
                "225422385464401916576702064962702223657",
                "321643232038364856755642403784958583400",
                "103137645577131216360093940240659123655"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-14369-eed08b83",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mackron/dr_libs/commit/b2197b2eb7bb609df76315bebf44db4ec2a1aed0",
        "target": {
            "file": "dr_flac.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "10191337702557558206654121460813971340",
            "length": 1539
        },
        "id": "CVE-2025-14369-f9c04617",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mackron/dr_libs/commit/b2197b2eb7bb609df76315bebf44db4ec2a1aed0",
        "target": {
            "file": "dr_flac.h",
            "function": "extension"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T14:52:29Z"