The vulnerability exists in dr_libs dr_flac.h (version 0.13.3 and earlier) where the function drflac__read_and_decode_metadata() does not properly control memory allocation size when parsing PICTURE metadata blocks. Specifically, attacker-controlled mimeLength and descriptionLength fields can trigger excessive memory allocation, potentially exhausting system memory and causing denial of service. The flaw is tracked as CWE-789 (Memory Allocation with Excessive Size Value). The CVSS 4.0 base score is 6.9, indicating medium severity, with local attack vector, low complexity, no privileges or user interaction required, and high impact on availability.

Successful exploitation allows an attacker to cause denial of service by exhausting system memory during FLAC stream processing. There is no indication of code execution or data corruption. The impact is limited to availability degradation on affected systems using vulnerable versions of dr_libs dr_flac.h.

The vulnerability has been fixed in commits fefced4, 4f5a4cd, and 663239a. Users should update to a version of dr_libs dr_flac.h that includes these fixes. Since no official patch links are provided, users should consult the vendor's repository or source control for these specific commits to apply the fix. Patch status is not yet confirmed via an official advisory; verify with the vendor for current remediation guidance.