Vulnerability in Mackron Miniaudio
CVE-2026-32837
miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.002 (6.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 6.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: -0.000
Affected products
- Mackron Miniaudio — versions 0, 1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde
Weakness classification (CWE)
References
- github.com/mackron/miniaudio/issues/1101 (issue-tracking, Exploit, Mitigation, Issue Tracking, Vendor Advisory)
- github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde (patch)
- github.com/mackron/dr_libs/commit/04e40d66a7ba1632f93ec1328d4b42ad986e3ee0 (patch)
- www.vulncheck.com/advisories/mackron-miniaudio-out-of-bounds-read-in-bext-codin… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-32837?
- CVE-2026-32837 is a medium-severity vulnerability in Mackron Miniaudio, classified under Improper Null Termination. CVSS score: 4.0/10. Published 2026-03-17.
- How severe is CVE-2026-32837?
- Medium severity. CVSS v3 base score is 4.0 out of 10.