{"id":"CVE-2026-11315","kind":"vulnerability","aliases":["CVE-2026-11315"],"related":[],"title":"dr_libs: crafted MP3 file causes out-of-bounds read in decoder","description":"A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.","summary":"dr_libs is a single-header C audio library, and its dr_mp3 decoder (drmp3_init_internal) mishandles a specially crafted MP3 file, causing an out-of-bounds read. An attacker who gets a malicious MP3 into an application that decodes it can read memory outside the buffer, which may leak data or crash the process.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["audio","c","dr_libs","mp3-decoding","package"],"not_affected_if":["different-version","no-untrusted-mp3-input"],"how_to_check":"- Check whether the project vendors or depends on dr_libs (search the source tree for `dr_mp3.h`).\n- Confirm the version in use is `0.7.3`, the version named by the advisory.","fix":null,"status":"open","published_at":"2026-11-10T16:17:17+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:23:43+00:00","updated_at":"2026-11-10T16:23:43+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T16:23:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"dr_libs: crafted MP3 file causes out-of-bounds read in decoder","impact":"low","summary":"dr_libs is a single-header C audio library, and its dr_mp3 decoder (drmp3_init_internal) mishandles a specially crafted MP3 file, causing an out-of-bounds read. An attacker who gets a malicious MP3 into an application that decodes it can read memory outside the buffer, which may leak data or crash the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["c","dr_libs","audio","mp3-decoding"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"memory read outside buffer, possible data leak or crash","analyst_note":"Check the upstream dr_libs repository and the NVD entry for a fixed version and whether the flaw is reachable through common decode paths.","how_to_check":"- Check whether the project vendors or depends on dr_libs (search the source tree for `dr_mp3.h`).\n- Confirm the version in use is `0.7.3`, the version named by the advisory.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-mp3-input","different-version"],"who_is_affected":"Applications that compile in dr_libs and decode MP3 files from untrusted sources, such as users' uploads or downloaded media, are exposed. Programs that only decode MP3 files they create or ship themselves are unlikely to be reached by an attacker. The sources do not name a fixed version.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000748,"input_tokens":4575,"output_tokens":580,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11315':16A,19A '-2026':15A,18A '0.7.3':107C 'applic':68B 'attack':60B,123C 'audio':20B,36B 'bound':10A,57B,90C,120C 'buffer':77B 'c':21B,35B 'caus':6A,52B 'craft':3A,49B,110C 'crash':83B 'cve':14A,17A 'data':81B 'decod':13A,26B,42B,70B 'dr':1A,22B,28B,40B,96C,103C 'drmp3':43B,98C 'exist':93C 'file':5A,51B,112C,128C 'function':101C 'get':62B 'header':34B 'init':44B,99C 'intern':45B,100C 'lead':114C 'leak':80B 'lib':2A,23B,29B,104C 'librari':37B 'malici':64B,127C 'may':79B 'memori':74B 'mishandl':46B 'mp3':4A,25B,41B,50B,65B,97C,111C 'mp3-decoding':24B 'out-of-bound':7A,54B,87C,117C 'outsid':75B 'packag':27B 'process':85B 'provid':125C 'read':11A,58B,73B,91C,121C 'singl':33B 'single-head':32B 'special':48B,109C 'trigger':130C 'version':105C 'vulner':92C,132C","nicknames":[],"mitigations":[],"who_affected":"Applications that compile in dr_libs and decode MP3 files from untrusted sources, such as users' uploads or downloaded media, are exposed. Programs that only decode MP3 files they create or ship themselves are unlikely to be reached by an attacker. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["audio","c","drlibs","medium","mp3decoding","package"],"campaign_type":null,"search_a":"'-11315':16A,19A '-2026':15A,18A 'bound':10A 'caus':6A 'craft':3A 'cve':14A,17A 'decod':13A 'dr':1A 'file':5A 'lib':2A 'mp3':4A 'out-of-bound':7A 'read':11A","search_b":"'applic':68B 'attack':60B 'audio':20B,36B 'bound':57B 'buffer':77B 'c':21B,35B 'caus':52B 'craft':49B 'crash':83B 'data':81B 'decod':26B,42B,70B 'dr':22B,28B,40B 'drmp3':43B 'file':51B 'get':62B 'header':34B 'init':44B 'intern':45B 'leak':80B 'lib':23B,29B 'librari':37B 'malici':64B 'may':79B 'memori':74B 'mishandl':46B 'mp3':25B,41B,50B,65B 'mp3-decoding':24B 'out-of-bound':54B 'outsid':75B 'packag':27B 'process':85B 'read':58B,73B 'singl':33B 'single-head':32B 'special':48B","search_c":"'0.7.3':107C 'attack':123C 'bound':90C,120C 'craft':110C 'dr':96C,103C 'drmp3':98C 'exist':93C 'file':112C,128C 'function':101C 'init':99C 'intern':100C 'lead':114C 'lib':104C 'malici':127C 'mp3':97C,111C 'out-of-bound':87C,117C 'provid':125C 'read':91C,121C 'special':109C 'trigger':130C 'version':105C 'vulner':92C,132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11315","severity":null,"published_at":"2026-11-10T16:17:17+00:00","modified_at":"2026-11-10T16:17:17+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}