# CVE-2026-32836: mackron dr_libs uncontrolled memory allocation in dr_flac.h

Source: https://junglewise.ai/threats/cve-2026-32836-mackron-dr-libs-uncontrolled-memory-allocation-in-dr-flac-h  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-17. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-32836 · Severity: medium · CVSS 6.2 · Published 2026-03-17

dr_flac is a popular C library used for decoding FLAC audio files. A vulnerability in how it handles audio metadata allows a specially crafted file to force the application to request massive amounts of system memory (up to 4GB). This can lead to the application crashing or the entire system becoming unresponsive, resulting in a denial of service.

Technologies: [Mackron Dr Libs](https://junglewise.ai/threats/technologies/dr-libs). Vendors: [Mackron](https://junglewise.ai/threats/vendors/mackron).

## Quick answers

**Is CVE-2026-32836 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32836 being exploited in the wild.

**How severe is CVE-2026-32836?** Medium severity, with a CVSS score of 6.2, published 17 March 2026.

**Which products and versions are affected?** Mackron Dr Flac 0.13.3 and earlier.

**Is there a fix for CVE-2026-32836?** A patch was published on 2026-03-17: Fixes committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32836 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-32836?** Check whether you run Mackron Dr Flac or Mackron Dr Libs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled memory allocation vulnerability (CWE-789) exists in the drflac__read_and_decode_metadata() function within dr_flac.h. The root cause is a failure to validate the mimeLength and descriptionLength fields against the actual remaining block size before performing a malloc() call. An attacker can provide a crafted FLAC stream with a PICTURE metadata block containing large length values, forcing an allocation of up to 4 GiB from a very small input. This vulnerability specifically affects entry points using drflac_open_*_with_metadata() when a non-NULL metadata callback is provided. The issue has been addressed in commits fefced4, 4f5a4cd, and 663239a.

## Affected products

- mackron dr_libs dr_flac.h 0.13.3 and earlier

## Timeline

- 2026-03-17: advisory: NVD publication date
- 2026-03-17: disclosed: GitHub issue 298 opened
- 2026-03-17: patched: Fixes committed to repository

## References

- [https://github.com/mackron/dr_libs/commit/4f5a4cd3b57564d969443c580c75857e039f100a](https://github.com/mackron/dr_libs/commit/4f5a4cd3b57564d969443c580c75857e039f100a)
- [https://github.com/mackron/dr_libs/commit/663239a3d0460c33bd5b6e5166edcb404e3df676](https://github.com/mackron/dr_libs/commit/663239a3d0460c33bd5b6e5166edcb404e3df676)
- [https://github.com/mackron/dr_libs/commit/fefced4a64adfb1a68a2d31d882366e56096dee8](https://github.com/mackron/dr_libs/commit/fefced4a64adfb1a68a2d31d882366e56096dee8)
- [https://github.com/mackron/dr_libs/issues/298](https://github.com/mackron/dr_libs/issues/298)
- [https://www.vulncheck.com/advisories/mackron-dr-libs-excessive-memory-allocation-in-picture-metadata-parsing](https://www.vulncheck.com/advisories/mackron-dr-libs-excessive-memory-allocation-in-picture-metadata-parsing)

## Related threats

- [dr_libs dr_wav out-of-bounds write in cue metadata parsing](https://junglewise.ai/threats/cve-2026-11316-a-out-of-bounds-write-vulnerability-exists-in-the-dr-wav-drwav)
- [dr_libs dr_mp3 out-of-bounds read in frame parsing](https://junglewise.ai/threats/cve-2026-11315-a-out-of-bounds-read-vulnerability-exists-in-the-dr-mp3-drmp3)
- [dr_libs dr_wav.h heap buffer overflow in drwav__read_smpl_to_metadata_obj](https://junglewise.ai/threats/cve-2026-29022-dr-libs-dr-wav-h-heap-buffer-overflow-in-drwav-read-smpl-to)