# CVE-2026-32837: Mackron miniaudio heap out-of-bounds read in WAV BEXT parser

Source: https://junglewise.ai/threats/cve-2026-32837-mackron-miniaudio-heap-out-of-bounds-read-in-wav-bext-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-17. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-32837 · Severity: medium · CVSS 4 · Published 2026-03-17

miniaudio is a popular audio playback and decoding library used in various software applications and games. A flaw in how the library processes WAV audio files could allow a specially crafted file to crash an application using the library. This could lead to a denial of service, impacting the reliability and availability of the affected software.

Vendors: [Mackron](https://junglewise.ai/threats/vendors/mackron).

## Quick answers

**Is CVE-2026-32837 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32837 being exploited in the wild.

**How severe is CVE-2026-32837?** Medium severity, with a CVSS score of 4, published 17 March 2026.

**Which products and versions are affected?** Mackron Dr Wav <= 0.11.25; Mackron Miniaudio <= 0.11.25.

**Is there a fix for CVE-2026-32837?** A patch was published on 2026-03-17: Fixes committed to GitHub repositories Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32837 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-32837?** Check whether you run Mackron Dr Wav or Mackron Miniaudio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap out-of-bounds read exists in the WAV BEXT metadata parser within miniaudio (and the underlying dr_wav library) due to improper null-termination. When parsing a Broadcast Extension (bext) chunk, the library allocates memory for the 'coding history' field but fails to explicitly write a null terminator after reading the data from the file. Subsequent calls to internal string length functions (ma_dr_wav__strlen) scan past the allocated buffer until a null byte is encountered in uninitialized heap memory. An attacker can exploit this by providing a crafted WAV file with a non-null-terminated BEXT chunk, leading to memory access violations and application crashes. The issue is fixed in miniaudio commit 1df46ae and dr_libs commit 04e40d6.

## Affected products

- mackron miniaudio <= 0.11.25
- mackron dr_wav <= 0.11.25

## Timeline

- 2026-03-09: disclosed: Vulnerability confirmed by researcher
- 2026-03-17: advisory
- 2026-03-17: patched: Fixes committed to GitHub repositories

## References

- [https://github.com/mackron/dr_libs/commit/04e40d66a7ba1632f93ec1328d4b42ad986e3ee0](https://github.com/mackron/dr_libs/commit/04e40d66a7ba1632f93ec1328d4b42ad986e3ee0)
- [https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde](https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde)
- [https://github.com/mackron/miniaudio/issues/1101](https://github.com/mackron/miniaudio/issues/1101)
- [https://www.vulncheck.com/advisories/mackron-miniaudio-out-of-bounds-read-in-bext-coding-history-parsing](https://www.vulncheck.com/advisories/mackron-miniaudio-out-of-bounds-read-in-bext-coding-history-parsing)

## Related threats

- [dr_libs dr_wav.h heap buffer overflow in drwav__read_smpl_to_metadata_obj](https://junglewise.ai/threats/cve-2026-29022-dr-libs-dr-wav-h-heap-buffer-overflow-in-drwav-read-smpl-to)