VULNERABILITY INTELLIGENCE

CVE-2026-32836

CVSS score6.2 MEDIUM
EPSS probability0.19%
CISA KEVNot currently listed
Published2026-03-17
Last modified2026-07-14
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vulnerability in drflac__read_and_decode_metadata() that allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can exploit attacker-controlled mimeLength and descriptionLength fields to cause denial of service through memory exhaustion when processing FLAC streams with metadata callbacks.

Weakness classification

  • disclosure@vulncheck.com: CWE-789

Primary references