Executive brief
dr_wav is a popular C library used by developers to decode and process WAV audio files in various applications. A security flaw in how the library handles metadata allows a specially crafted audio file to corrupt the computer's memory. If a user opens a malicious WAV file with an application using this library, it could lead to a program crash or potentially allow an attacker to take control of the system.
Technical details
A heap-based buffer overflow exists in dr_wav.h within the drwav__read_smpl_to_metadata_obj() function. The vulnerability stems from a logic mismatch in a two-pass metadata parser: pass 1 validates the 'sampleLoopCount' field to determine allocation size, but pass 2 processes 'smpl' chunks unconditionally. By providing a crafted WAV file where these passes disagree, an attacker can trigger an out-of-bounds write of 36 bytes of controlled data. This is reachable via any drwav_init_*_with_metadata() call. The issue was fixed in commit 8a7258c (released as version 0.14.5).
Affected products
- dr_libs (mackron) dr_wav.h <= 0.14.4
Timeline
- 2026-02-27: disclosed: Reported by Ana Kapulica of Marlink Cyber
- 2026-02-28: advisory
- 2026-03-03: patched: Fixed in commit 8a7258c / version 0.14.5
References
- https://github.com/mackron/dr_libs/commit/8a7258cc66b49387ad58cc5b81568982a3560d49
- https://github.com/mackron/dr_libs/issues/296
- https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2026-001-dr-libs-heap-overflow.md
- https://www.vulncheck.com/advisories/mackron-dr-libs-heap-buffer-overflow-via-wav-file