CVE-2026-29022: CWE-122 Heap-based Buffer Overflow in mackron dr_libs dr_wav.h
dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.
AI Analysis
Technical Summary
CVE-2026-29022 is a heap-based buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_libs dr_wav.h versions 0.14.4 and earlier. The vulnerability arises from a mismatch in validation logic for sampleLoopCount between the first and second processing passes, enabling an attacker to overflow heap allocations by 36 bytes with crafted WAV files. This overflow occurs during any drwav_init_*_with_metadata() call when processing untrusted input. The vulnerability is addressed in a commit identified as 8a7258c.
Potential Impact
Exploitation of this vulnerability can lead to heap memory corruption, which may result in application crashes or potentially arbitrary code execution depending on the context in which the vulnerable function is used. The vulnerability requires local access (AV:L) and user interaction (UI:A) but does not require privileges. The overall CVSS 4.0 base score is 6.8 (medium severity), indicating a moderate risk.
Mitigation Recommendations
A fix for this vulnerability is available and was introduced in commit 8a7258c. Users and developers should update dr_libs dr_wav.h to a version that includes this commit or later. Until patched, avoid processing untrusted WAV files with drwav_init_*_with_metadata() functions to mitigate risk.
CVE-2026-29022: CWE-122 Heap-based Buffer Overflow in mackron dr_libs dr_wav.h
Description
dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.
CVSS v4.0
Score 6.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-29022 is a heap-based buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_libs dr_wav.h versions 0.14.4 and earlier. The vulnerability arises from a mismatch in validation logic for sampleLoopCount between the first and second processing passes, enabling an attacker to overflow heap allocations by 36 bytes with crafted WAV files. This overflow occurs during any drwav_init_*_with_metadata() call when processing untrusted input. The vulnerability is addressed in a commit identified as 8a7258c.
Potential Impact
Exploitation of this vulnerability can lead to heap memory corruption, which may result in application crashes or potentially arbitrary code execution depending on the context in which the vulnerable function is used. The vulnerability requires local access (AV:L) and user interaction (UI:A) but does not require privileges. The overall CVSS 4.0 base score is 6.8 (medium severity), indicating a moderate risk.
Mitigation Recommendations
A fix for this vulnerability is available and was introduced in commit 8a7258c. Users and developers should update dr_libs dr_wav.h to a version that includes this commit or later. Until patched, avoid processing untrusted WAV files with drwav_init_*_with_metadata() functions to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-03-03T17:24:13.913Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69a73e9ad1a09e29cb7489d3
Added to database: 03/03/2026, 20:03:38 UTC
Last enriched: 07/30/2026, 00:33:42 UTC
Last updated: 07/31/2026, 21:26:47 UTC
Views: 230
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.