CVE-2026-29022

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29022", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-03-03T17:24:13.913Z", "datePublished": "2026-03-03T19:49:16.581Z", "dateUpdated": "2026-07-28T01:48:30.401Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:48:30.401Z"}, "title": "mackron / dr_libs dr_wav.h Heap Buffer Overflow via WAV File", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "type": "CWE"}]}], "affected": [{"vendor": "mackron", "product": "dr_libs dr_wav.h", "repo": "https://github.com/mackron/dr_libs", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "0.14.4", "versionType": "semver"}, {"status": "unaffected", "version": "8a7258cc66b49387ad58cc5b81568982a3560d49", "versionType": "git"}], "defaultStatus": "unaffected", "packageURL": "pkg:github/mackron/dr_libs"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mackron:dr_libs:*:*:*:*:*:*:*:*", "versionEndIncluding": "0.14.4"}]}]}], "descriptions": [{"lang": "en", "value": "dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input."}]}], "references": [{"url": "https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2026-001-dr-libs-heap-overflow.md", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/mackron/dr_libs/issues/296", "tags": ["issue-tracking"]}, {"url": "https://github.com/mackron/dr_libs/commit/8a7258cc66b49387ad58cc5b81568982a3560d49", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/mackron-dr-libs-heap-buffer-overflow-via-wav-file", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Ana Kapulica", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T21:13:58.314688Z", "id": "CVE-2026-29022", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:14:13.488Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29022", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T21:13:58.314688Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:14:08.519Z"}}], "cna": {"title": "mackron / dr_libs dr_wav.h Heap Buffer Overflow via WAV File", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Ana Kapulica"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/mackron/dr_libs", "vendor": "mackron", "product": "dr_libs dr_wav.h", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.14.4"}, {"status": "unaffected", "version": "8a7258cc66b49387ad58cc5b81568982a3560d49", "versionType": "git"}], "packageURL": "pkg:github/mackron/dr_libs", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2026-001-dr-libs-heap-overflow.md", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/mackron/dr_libs/issues/296", "tags": ["issue-tracking"]}, {"url": "https://github.com/mackron/dr_libs/commit/8a7258cc66b49387ad58cc5b81568982a3560d49", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/mackron-dr-libs-heap-buffer-overflow-via-wav-file", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.", "supportingMedia": [{"type": "text/html", "value": "dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mackron:dr_libs:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "0.14.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:48:30.401Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29022", "state": "PUBLISHED", "dateUpdated": "2026-07-28T01:48:30.401Z", "dateReserved": "2026-03-03T17:24:13.913Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-03-03T19:49:16.581Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/mackron/dr_libs", "product": "dr_libs dr_wav.h", "repo": "https://github.com/mackron/dr_libs", "vendor": "mackron", "versions": [{"lessThanOrEqual": "0.14.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "8a7258cc66b49387ad58cc5b81568982a3560d49", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mackron:dr_libs:*:*:*:*:*:*:*:*", "matchCriteriaId": "69CB7A4E-AEB5-4132-A385-E73F6C7E3FCC", "versionEndIncluding": "0.14.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input."}, {"lang": "es", "value": "dr_libs versi\u00f3n 0.14.4 y anteriores (corregido en el commit 8a7258c) contienen una vulnerabilidad de desbordamiento de b\u00fafer de pila en la funci\u00f3n drwav__read_smpl_to_metadata_obj() de dr_wav.h que permite la corrupci\u00f3n de memoria a trav\u00e9s de archivos WAV manipulados. Los atacantes pueden explotar una discrepancia entre la validaci\u00f3n de sampleLoopCount en el paso 1 y el procesamiento incondicional en el paso 2 para desbordar las asignaciones de pila con 36 bytes de datos controlados por el atacante a trav\u00e9s de cualquier llamada a drwav_init_*_with_metadata() en entrada no confiable."}], "id": "CVE-2026-29022", "lastModified": "2026-07-14T19:16:55.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29022", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T21:13:58.314688Z", "version": "2.0.3"}}]}, "published": "2026-03-03T20:16:49.433", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/mackron/dr_libs/commit/8a7258cc66b49387ad58cc5b81568982a3560d49"}, {"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/mackron/dr_libs/issues/296"}, {"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2026-001-dr-libs-heap-overflow.md"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.vulncheck.com/advisories/mackron-dr-libs-heap-buffer-overflow-via-wav-file"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.14.4]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "commit 8a7258c"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "dr_libs", "vendor": "mackron"}], "analysis": {"en": {"generated_at": "2026-04-17T13:20:48.427835+00:00", "value": {"mitigation_remediation": ["Update dr_libs to the latest release that includes the fix from commit 8a7258c.", "If upgrading immediately is not possible, remove or disable any code paths that invoke drwav_init_*_with_metadata() for externally sourced data; alternatively, validate the sampleLoopCount and metadata headers before parsing.", "Restrict the processing of WAV files to trusted users only and scan or sanitize all uploaded files for well\u2011formed headers and loop structures before passing them to the library."], "summary": {"action": "Apply Patch", "impact": "Heap buffer overflow causing memory corruption"}, "threat_synthesis": {"affected_systems": "The affected product is dr_libs dr_wav.h version 0.14.4 and earlier, used by developers and applications that incorporate this open\u2011source library. The vendor is mackron.", "description_and_impact": "The vulnerability resides in the drwav__read_smpl_to_metadata_obj() function of dr_libs dr_wav.h (versions 0.14.4 and earlier). It is a heap buffer overflow that occurs when the sampleLoopCount validation in the first pass is not matched by unconditional processing in the second pass, allowing an attacker to overflow 36 bytes of attacker\u2011controlled data. This memory corruption can compromise the integrity of the process running drwav_init_*_with_metadata() on untrusted WAV files, potentially leading to denial of service or arbitrary code execution.", "risk_and_exploitability": "The vulnerability carries a medium severity rating (CVSS 6.8) and the likelihood of exploitation is currently considered very low (EPSS < 1%). The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a specially crafted WAV file to be processed by a vulnerable application that calls drwav_init_*_with_metadata(); when triggered, the overflow can be performed without additional privileges, providing a potential local or remote attack surface depending on the deployment scenario."}}}}, "created": "2026-03-04T14:54:02.163206+00:00", "updated": "2026-04-17T13:30:19.597532+00:00", "vendors": ["mackron", "mackron$PRODUCT$dr_libs"]}