CVE-2026-111164
Received Received - Intake

UADE Out-of-Bounds Read in amifilemagic.c

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description
UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applications that probe or play it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-111164
EUVD
EUVD-2026-102291

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
UADE uade 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

UADE through version 3.05 has an out-of-bounds read vulnerability in the uade_filemagic() function. This occurs due to an unsigned integer underflow when subtracting buffer size for short module inputs. Attackers can craft a short module that bypasses bounds checks, causing reads beyond the allocated buffer and crashing applications that process or play it.

Detection Guidance

To detect this vulnerability, inspect systems running UADE versions up to 3.05. Check for crashes in applications using UADE for module detection like Audacious or DeaDBeeF when processing Amiga music modules. Examine logs for out-of-bounds read errors in amifilemagic.c. Use static analysis tools to identify unsigned integer underflow in buffer size calculations.

Impact Analysis

This vulnerability can cause applications using UADE to crash or experience denial of service. It may affect media players like Audacious or DeaDBeeF that process Amiga music modules. Attackers only need an 8-byte crafted file to trigger the issue.

Mitigation Strategies

Immediately update UADE to the latest version beyond 3.05. If updating is not possible, disable UADE or restrict its use to trusted module files only. Implement input validation to reject short module files before processing. Monitor applications using UADE for crashes or unusual behavior.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111164. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart