CVE-2026-32837
Medium · 4.0CVSS
4.0
EPSS
0.2%
Published
Mar 17, 2026
CISA due date
—
The record
miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-12386 Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research… CWE-170
- CVE-2026-5067 A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server… CWE-170
- CVE-2026-8721 Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded… CWE-170
- CVE-2026-42010 A flaw was found in gnutls. CWE-170
- CVE-2026-34462 Sandboxie-Plus is an open source sandbox-based isolation software for Windows. CWE-170
- CVE-2026-34464 Sandboxie-Plus is an open source sandbox-based isolation software for Windows. CWE-170
- CVE-2026-34032 Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. CWE-170
- CVE-2026-40334 libgphoto2 is a camera access and control library. CWE-170