CVE-2026-29022

HighCVSS 7.3

Published: 03/03/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

In dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c), a heap buffer overflow vulnerability exists in the drwav__read_smpl_to_metadata_obj() function. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to corrupt memory via crafted WAV files.

Risk Assessment

The organization is at risk of remote code execution or application crash by supplying a malicious WAV file, potentially leading to data integrity and system availability breaches.

Recommendation

Immediately update the dr_libs library to a version containing commit 8a7258c or later, and avoid processing untrusted WAV files without proper validation.

Other vulnerabilities in dr_libs

CVE-2026-71261High
dr_libs dr_wav.h contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.

Original NVD description (English source)

dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.