CVE-2026-11315 · Package
NO FIX YET
dr_libs is a single-header C audio library, and its dr_mp3 decoder (drmp3_init_internal) mishandles a specially crafted MP3 file, causing an out-of-bounds read. An attacker who gets a malicious MP3 into an application that decodes it can read memory outside the buffer, which may leak data or crash the process.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that compile in dr_libs and decode MP3 files from untrusted sources, such as users' uploads or downloaded media, are exposed. Programs that only decode MP3 files they create or ship themselves are unlikely to be reached by an attacker. The sources do not name a fixed version.
Not affected if different-version, no-untrusted-mp3-input
Who cares audio, c, dr_libs, mp3-decoding
dr_mp3.h).0.7.3, the version named by the advisory.No fix yet, per the sources.
A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.