Executive brief
miniaudio is a popular audio playback and decoding library used in various software applications and games. A flaw in how the library processes WAV audio files could allow a specially crafted file to crash an application using the library. This could lead to a denial of service, impacting the reliability and availability of the affected software.
Technical details
A heap out-of-bounds read exists in the WAV BEXT metadata parser within miniaudio (and the underlying dr_wav library) due to improper null-termination. When parsing a Broadcast Extension (bext) chunk, the library allocates memory for the 'coding history' field but fails to explicitly write a null terminator after reading the data from the file. Subsequent calls to internal string length functions (ma_dr_wav__strlen) scan past the allocated buffer until a null byte is encountered in uninitialized heap memory. An attacker can exploit this by providing a crafted WAV file with a non-null-terminated BEXT chunk, leading to memory access violations and application crashes. The issue is fixed in miniaudio commit 1df46ae and dr_libs commit 04e40d6.
Affected products
- mackron miniaudio <= 0.11.25
- mackron dr_wav <= 0.11.25
Timeline
- 2026-03-09: disclosed: Vulnerability confirmed by researcher
- 2026-03-17: advisory
- 2026-03-17: patched: Fixes committed to GitHub repositories
References
- https://github.com/mackron/dr_libs/commit/04e40d66a7ba1632f93ec1328d4b42ad986e3ee0
- https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde
- https://github.com/mackron/miniaudio/issues/1101
- https://www.vulncheck.com/advisories/mackron-miniaudio-out-of-bounds-read-in-bext-coding-history-parsing