The vulnerability exists in dr_libs' dr_wav.h file within the drwav__metadata_process_chunk function. It improperly handles the 64-bit W64 chunk size by truncating it to size_t on 32-bit systems before dividing by a constant, resulting in an integer overflow. This causes the pre-allocated capacity for extra metadata to be miscalculated, potentially leading to buffer overflows or memory corruption.

Successful exploitation could result in high impact including confidentiality, integrity, and availability loss due to memory corruption. The CVSS 3.1 score is 7.8 (high), indicating that an attacker with local access and no privileges could cause significant damage, though user interaction is required.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid running the vulnerable code on 32-bit systems or limit exposure to untrusted input that triggers W64 CUE chunk metadata parsing.