CVE-2026-32837: Mackron miniaudio heap out-of-bounds read in WAV BEXT parser

CVE-2026-32837 · Severity: medium · CVSS 4 · Published 2026-03-17

miniaudio is a popular audio playback and decoding library used in various software applications and games. A flaw in how the library processes WAV audio files could allow a specially crafted file to crash an application using the library. This could lead to a denial of service, impacting the reliability and availability of the affected software.

Vendors: Mackron.

Quick answers

Is CVE-2026-32837 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32837 being exploited in the wild.
How severe is CVE-2026-32837?
Medium severity, with a CVSS score of 4, published 17 March 2026.
Which products and versions are affected?
Mackron Dr Wav <= 0.11.25; Mackron Miniaudio <= 0.11.25.
Is there a fix for CVE-2026-32837?
A patch was published on 2026-03-17: Fixes committed to GitHub repositories Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32837 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-32837?
Check whether you run Mackron Dr Wav or Mackron Miniaudio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap out-of-bounds read exists in the WAV BEXT metadata parser within miniaudio (and the underlying dr_wav library) due to improper null-termination. When parsing a Broadcast Extension (bext) chunk, the library allocates memory for the 'coding history' field but fails to explicitly write a null terminator after reading the data from the file. Subsequent calls to internal string length functions (ma_dr_wav__strlen) scan past the allocated buffer until a null byte is encountered in uninitialized heap memory. An attacker can exploit this by providing a crafted WAV file with a non-null-terminated BEXT chunk, leading to memory access violations and application crashes. The issue is fixed in miniaudio commit 1df46ae and dr_libs commit 04e40d6.

Affected products

  • mackron miniaudio <= 0.11.25
  • mackron dr_wav <= 0.11.25

Timeline

  • 2026-03-09: disclosed: Vulnerability confirmed by researcher
  • 2026-03-17: advisory
  • 2026-03-17: patched: Fixes committed to GitHub repositories

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.