CVE-2026-32837

miniaudio version 0.11.25 and earlier contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.

References

Affected packages

Git / github.com/mackron/miniaudio

Affected ranges

Type

GIT

Repo

https://github.com/mackron/miniaudio

Events

Introduced

Last affected

9634bedb5b5a2ca38c1ee7108a9358a4e233f14d

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.11.25"
        }
    ]
}

Affected versions

0.*

0.11.15

0.11.16

0.11.17

0.11.18

0.11.19

0.11.20

0.11.21

0.11.22

0.11.23

0.11.24

0.11.25

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32837.json"