CVE-2026-32837

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32837
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32837.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32837
Downstream
Published
2026-03-17T19:10:06.080Z
Modified
2026-08-12T15:32:26.962293Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
mackron / miniaudio Out-of-Bounds Read in BEXT Coding History Parsing
Details

miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32837.json",
    "cwe_ids": [
        "CWE-170"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/mackron/dr_libs

Affected ranges

Type
GIT
Repo
https://github.com/mackron/dr_libs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
04e40d66a7ba1632f93ec1328d4b42ad986e3ee0
Database specific
Show details 
{
    "source": "REFERENCES"
}
Type
GIT
Repo
https://github.com/mackron/miniaudio
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:mackron:miniaudio:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.11.25"
        }
    ]
}

Affected versions

0.*
0.11.15
0.11.16
0.11.17
0.11.18
0.11.19
0.11.20
0.11.21
0.11.22
0.11.23
0.11.24
0.11.25
flac-0.*
flac-0.12.43
flac-0.13.0
flac-0.13.1
flac-0.13.2
flac-0.13.3
mp3-0.*
mp3-0.6.40
mp3-0.7.0
mp3-0.7.1
mp3-0.7.2
mp3-0.7.3
wav-0.*
wav-0.13.17
wav-0.14.0
wav-0.14.1
wav-0.14.2
wav-0.14.3
wav-0.14.4
wav-0.14.5

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2026-32837-11a13c72",
        "target": {
            "function": "ma_dr_wav__metadata_process_chunk",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "68740539282378235448736197464329687364",
            "length": 8794.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-25da526e",
        "target": {
            "function": "ma_dr_flac__seek_to_pcm_frame__binary_search_internal",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "215916936038680883975386106498656468541",
            "length": 1787.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-2ef77232",
        "target": {
            "function": "ma_dr_wav__pcm_to_f32",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "188912483529563539375994585730094931795",
            "length": 830.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-517673ef",
        "target": {
            "function": "ma_dr_wav__read_smpl_to_metadata_obj",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "252958945724894409682966720291676995391",
            "length": 2567.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-5746ab02",
        "target": {
            "function": "ma_dr_mp3__full_read_and_close_s16",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "101194492292128629680745204175165742789",
            "length": 1168.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-57f16af8",
        "target": {
            "function": "ma_dr_mp3__full_read_and_close_f32",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "101194492292128629680745204175165742789",
            "length": 1168.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-6bd76b2e",
        "target": {
            "function": "ma_dr_wav__read_chunk_header",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "215566583383861985526553710739644911550",
            "length": 910.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-70a53380",
        "target": {
            "function": "ma_dr_mp3_init_internal",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "128465750684540150957112266858967811974",
            "length": 6311.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-7ef0da87",
        "target": {
            "function": "ma_dr_flac__read_and_decode_metadata",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "244400283984234237851516751409597227900",
            "length": 10642.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-81ac560d",
        "target": {
            "file": "dr_wav.h"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "75331902515497510300610705167564788972",
                "213864069237770781923711374017891281731",
                "262060013769418571190546223575201366272",
                "238512186141249962132771310701398940727",
                "165115212910164745610985578653748848851",
                "278240259285042136071991589731857097944",
                "220938037336958148249211254130902286798",
                "327708597962943320358071630195821231237",
                "60799623647573406518182611942323593155",
                "119763434519947992881935478934869808017"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/dr_libs/commit/04e40d66a7ba1632f93ec1328d4b42ad986e3ee0",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-32837-9b952661",
        "target": {
            "function": "ma_dr_wav__read_bext_to_metadata_obj",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "224675603668634189087211808518392287251",
            "length": 2580.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-a165f4b7",
        "target": {
            "function": "drwav__read_bext_to_metadata_obj",
            "file": "dr_wav.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "172490312644354067152343630816113108963",
            "length": 2527.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/dr_libs/commit/04e40d66a7ba1632f93ec1328d4b42ad986e3ee0",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-b201bc3c",
        "target": {
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "156795787947303449052969177408990759377",
                "141419661303167427615897883497554907320",
                "11407771528057744809405803805058737692",
                "156795787947303449052969177408990759377",
                "210141542460771396834585546146111188964",
                "173114714564113221479267754777981282454",
                "156795787947303449052969177408990759377",
                "197182503734544545109986340670891564286",
                "99357272242065514340523418171138250984",
                "71905810252351707287787321726041934968",
                "229776090783436448654828728183701419333",
                "216152195258853321617478784590712008445",
                "264271642273227327016781914603930287526",
                "216194198067743006897437782423111034433",
                "185086442592269957910289152110256003305",
                "68384926574209124990957157580406814754",
                "238063745532076325699063115400807811931",
                "1048104556783380368568766814268175428",
                "274557993652849148758141429123566639429",
                "225642820603357974364421819444424980592",
                "173312946142870966308799148015756664276",
                "56856718259211090881108536122190617184",
                "295256873307382544113332213235091727950",
                "188134522881775639006102605421522360979",
                "64539253930926581862044928390960188806",
                "162139126119991599277792522946890477648",
                "96098372908421112825348017051606773241",
                "58450664191326420030381026614073956566",
                "38668262523179058787201542542805167757",
                "133086029401906904839974825795702921503",
                "302066309391086746404115321638870597260",
                "137473062277687131855933626122562922509",
                "150988054713379878559474820287497058483",
                "44369005812242189072277796348876902910",
                "33195052054675371581669255406082753671",
                "227551164481302186549371676330476349574",
                "204920506132837892334228655212893250315",
                "329769169739008168521918159950623411152",
                "206534274737368250011127276971143727950",
                "339051540865886879635987362271192374296",
                "294556709203475025845081866887453551497",
                "261539579631334770699581492336343103381",
                "161620657529717636588521587436470868437",
                "339051540865886879635987362271192374296",
                "294556709203475025845081866887453551497",
                "86043823394197261960179899920452679432",
                "244081426415139549638800058678589763069",
                "339051540865886879635987362271192374296",
                "294556709203475025845081866887453551497",
                "232188431606331892781663361493432963322",
                "61801049656525861493159593412375798774",
                "55656714534295307734427502696117972483",
                "27984394316452761574263703716462835280",
                "142693911158826151791735041304840868131",
                "142772340235232863849072663692373632774",
                "86850882485109552784944898908450973409",
                "84554220024801620264357316806685987467",
                "145992144050348534107929967912397838067",
                "66271055394673689420479575236316948122",
                "77605408132086908290550544469135394653",
                "230673840254919438056351360903457630264",
                "265583596197409742259939179336906784982",
                "241629993655621792303365911721144545808",
                "226349004335534441904716088151718018897",
                "253203063526383212129071731897078609187",
                "88270639829247998763141997963369236052",
                "129659042824977538151522649810437718248",
                "255981787844955546323123447362054730188",
                "35372402919668016605905707031120522841",
                "185614157368501841958952582306019821146",
                "276596541074949081055904615153657264792",
                "4847881200190529886993575456665583513",
                "43062854649422008573971928635853824004",
                "110378666986850686609715941402472347421",
                "224768287864435169447500720621253906697",
                "153453767315731798618888688923764390123",
                "334583330722925138397028011353522909775",
                "180512305484630660105845367698513677888",
                "324492245290075172150530725285281487808",
                "83854850565314035569582192717915132294",
                "305351904994496842906852670004339581234",
                "297015941264432611495592536835619405913",
                "264122046991060135958074768807838543257",
                "265378277774730444105585068611574844498",
                "108728622203328714155660927793012438327",
                "31879221662564285298129361631460085036",
                "68476147814077043406722888148211230850",
                "201008313671546030805248257731583673298",
                "195908854238769574885364609844215415269",
                "52880431107984347475444307464573650",
                "310218586785793753360952553693237536167",
                "79988626947779151124635975698380913062",
                "151956542819820935062001410208788484104",
                "160875838034720920375081616905333900821",
                "264140366541011963976864472671635359826",
                "335933828976610046719563620668562755253",
                "296001994995493964553788538303157327565",
                "1688906611421727691297715511728092725",
                "294085047969993414718651795594106646520",
                "92686251692444571601125601556958949439",
                "84347194778445216101785047290936258325",
                "231810115165519663070623535721399411711",
                "55433131582539464930626343920353786920",
                "223894584098009260988789564831469003631",
                "150815495160009260843532861059074911051",
                "251096986949217577681742210151508455939",
                "170545353283505009664843220747986924369",
                "238872186207607521410056143236598247320",
                "307365942892891981421828006784412234079",
                "333291389358151107494654714653855701453",
                "197155663002124808382028778813169462711",
                "177024200601483591071170911336529795311",
                "177499068723068303184284888476226020918",
                "93561269076110678668084086851612335845",
                "199134499302240393360054631171619828467",
                "89486706713801711977962723053719418126",
                "258820451143758077748223001103912436304",
                "309377564863190031904135384021621687899",
                "210899361754263052448050621271057853530",
                "5555567528076831037577234751045418788",
                "30152539794424821934868639628202287420",
                "185588900909905375381879718972704539472",
                "9897198679744047076628866938661786858",
                "35397904717656158466898001501428533839",
                "118701389049885871588691134106627519722",
                "93306011799935964617180512392883048882",
                "260378445198078886786727672537477140794",
                "298159172968649215466077119775956410996",
                "280817939847258487403206496091612695914",
                "259228508288845388879877808524404419164",
                "280296374176817210079197876166955524046",
                "241778387033947027916511032876700545806",
                "303237997275654928975931217588279495587",
                "82401450315979446080526893460548038967",
                "22945832634496829644512014742550382277",
                "131245478691863183240804499883652283180",
                "225959437045802725103830580544061254490",
                "208671584943073334167278998885214329746",
                "264347041600734690453482839950972716735",
                "114732501480354417315611481383157138039",
                "285669756901705627221472303795822937255",
                "73967073793382726489529559801083281183",
                "34288355358264039782439614592741186345",
                "172581523777171434576808549979131145353",
                "269856975859467623809027508076665255784",
                "99320275881309858412610233395400764686",
                "183455404470646133284767200289174695255",
                "293135976527019955018431332334604213843",
                "231168693809067654804024545056230069966",
                "111782256486646138047148380604117676",
                "257150508685331546771169364579495895135",
                "314428552583571166205574244442118720505",
                "37644698135911176302766125240989401438",
                "99539766417530972188664162549287582514",
                "71711448251374412226282963090725483462",
                "244253792912668380464888835458842381480",
                "118442132250424325521920380203318146748",
                "235262983709483128645285653223491821990",
                "119616314531377362361269517921002376249",
                "236568338718830657315082935247658844676",
                "246296719835452432276128664771074117131",
                "187803239905253126080793144027951266579",
                "115529163574252360002190633383859501996",
                "56077022089391231499295916949101747491",
                "284209986880824339426399198810772498936",
                "36725782109712502764995259784240787439",
                "1065714635162166310640821053776299940",
                "230373423882978196781119463496494071044",
                "150203700137933613269777540137361625548",
                "20742834199292810533950173261144069717",
                "68325779105070840431450875291497235020",
                "139090914289421356871000879565731054557",
                "164950736488504337008708048304528397036",
                "313508218489527092054623993392043217101",
                "319284798327792483404017492618454243262",
                "126297450485197815773988390304472077992",
                "217589861131262676659951221956114568873"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-32837-b984edd4",
        "target": {
            "function": "ma_dr_flac_open_with_metadata_private",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "75692032195145091718144805929960777526",
            "length": 4804.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-cf7b8573",
        "target": {
            "function": "ma_dr_wav_init__internal",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "263229805842504126809509328171199097716",
            "length": 16687.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-d0b8ad0b",
        "target": {
            "function": "ma_dr_mp3_read_pcm_frames_f32",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "72621988515577566839537940079860476685",
            "length": 915.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-d2d1aaa8",
        "target": {
            "function": "ma_dr_wav__pcm_to_s32",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "154389684596819775323870349498602488804",
            "length": 851.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-e36859a7",
        "target": {
            "function": "ma_dr_mp3_read_pcm_frames_s16",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "135371906402038154958269751331255992240",
            "length": 913.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-32837-eb64bfe3",
        "target": {
            "function": "ma_dr_wav__pcm_to_s16",
            "file": "miniaudio.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "646145887471522308075005652160598209",
            "length": 842.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde",
        "signature_type": "Function"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32837.json"
vanir_signatures_modified 
"2026-08-12T15:32:26Z"