CVE-2026-71261
Received Received - Intake

Heap Buffer Overflow in dr_libs WAV Parser

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk(), a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly. The subsequent read in drwav__read_cue_to_metadata_obj() computes the actual cue point count and allocation size using the full-precision, attacker-controlled cuePointCount field without cross-checking it against the stage-1 capacity estimate, and the only bounds enforcement on the resulting memory region (drwav__metadata_get_memory()) is a DRWAV_ASSERT, which compiles to a no-op under -DNDEBUG (the default for release builds). A crafted W64 WAV file can therefore cause a heap buffer overflow in any 32-bit application parsing untrusted WAV metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71261
EUVD
EUVD-2026-53346

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dr_libs dr_wav to current_master (inc)
mackron dr_libs to current_master (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow in the dr_libs dr_wav.h library affecting all versions up to current master. It occurs during parsing of W64 CUE chunk metadata in WAV files. On 32-bit systems, a calculation truncates a 64-bit chunk size to a smaller size_t value, causing incorrect memory allocation. The actual cue point count is then read without validating against the initial estimate, leading to a heap buffer overflow when processing malicious WAV files.

Detection Guidance

This vulnerability involves a heap buffer overflow in 32-bit applications parsing W64 WAV files using dr_wav.h. Detection requires checking for applications using this library and analyzing WAV file processing. No direct detection commands are provided in the context. Monitor for crashes or memory corruption when processing WAV files in 32-bit environments.

Impact Analysis

If you use a 32-bit application that relies on dr_wav.h to parse untrusted WAV files, this vulnerability could allow attackers to execute arbitrary code or crash your application by causing a heap buffer overflow. This affects any software using the library to process WAV files from untrusted sources.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling heap buffer overflows in 32-bit applications parsing untrusted WAV metadata. Such overflows may lead to arbitrary code execution, data corruption, or denial of service, which could compromise the confidentiality, integrity, or availability of personal or health data.

Mitigation Strategies

Update dr_libs to the latest version where the vulnerability is patched. Avoid using 32-bit builds of applications parsing WAV files. Disable parsing of WAV metadata from untrusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71261. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart