UBUNTU-CVE-2026-29508

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-29508

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-29508.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-29508

Upstream

CVE-2026-29508

Published

2026-11-03T00:00:00Z

Modified

2026-11-04T03:30:12Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.

References

Affected packages

Ubuntu:20.04:LTS

minidlna

Package

Name: minidlna
Purl: pkg:deb/ubuntu/minidlna?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.1+dfsg-1build1

1.2.1+dfsg-1ubuntu0.20.04.1

1.2.1+dfsg-1ubuntu0.20.04.2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "minidlna",
            "binary_version": "1.2.1+dfsg-1ubuntu0.20.04.2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-29508.json"

Ubuntu:22.04:LTS

minidlna

Package

Name: minidlna
Purl: pkg:deb/ubuntu/minidlna?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.0+dfsg-2

1.3.0+dfsg-2.1

1.3.0+dfsg-2.1ubuntu0.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "minidlna",
            "binary_version": "1.3.0+dfsg-2.1ubuntu0.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-29508.json"

Ubuntu:24.04:LTS

minidlna

Package

Name: minidlna
Purl: pkg:deb/ubuntu/minidlna?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.3+dfsg-0.1

1.3.3+dfsg-0.2

1.3.3+dfsg-1

1.3.3+dfsg-1build1

1.3.3+dfsg-1build2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "minidlna",
            "binary_version": "1.3.3+dfsg-1build2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-29508.json"

Ubuntu:26.04:LTS

minidlna

Package

Name: minidlna
Purl: pkg:deb/ubuntu/minidlna?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.3+dfsg-1.1build1

1.3.3+dfsg-1.1build2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "minidlna",
            "binary_version": "1.3.3+dfsg-1.1build2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-29508.json"

Ubuntu:26.10

minidlna

Package

Name: minidlna
Purl: pkg:deb/ubuntu/minidlna?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.3+dfsg-1.1build2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "minidlna",
            "binary_version": "1.3.3+dfsg-1.1build2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-29508.json"

Ubuntu:Pro:16.04:LTS

minidlna

Package

Name: minidlna
Purl: pkg:deb/ubuntu/minidlna?arch=source&distro=esm-apps%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.1.4+dfsg-4build1

1.1.5+dfsg-1

1.1.5+dfsg-2

1.1.5+dfsg-2ubuntu0.1

1.1.5+dfsg-2ubuntu0.1+esm1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "minidlna",
            "binary_version": "1.1.5+dfsg-2ubuntu0.1+esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-29508.json"

Ubuntu:Pro:18.04:LTS

minidlna

Package

Name: minidlna
Purl: pkg:deb/ubuntu/minidlna?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.0+dfsg-2

1.2.1+dfsg-1

1.2.1+dfsg-1ubuntu0.18.04.1

1.2.1+dfsg-1ubuntu0.18.04.1+esm1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "minidlna",
            "binary_version": "1.2.1+dfsg-1ubuntu0.18.04.1+esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-29508.json"