Vulnerability in Mackron Miniaudio
CVE-2026-32837
miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.
EPSS: 0.002 (13.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Mackron Miniaudio — versions 0, 1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde
Weakness classification (CWE)
References
- disclosure@vulncheck.com (issue-tracking, Exploit, Mitigation, Issue Tracking, Vendor Advisory)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-32837?
- CVE-2026-32837 is a medium-severity vulnerability in Mackron Miniaudio, classified under Improper Null Termination. CVSS score: 4.0/10. Published 2026-03-17.
- How severe is CVE-2026-32837?
- Medium severity. CVSS v3 base score is 4.0 out of 10.