---
id: "CVE-2026-11315"
page: "https://infrastack.ai/live/CVE-2026-11315"
kind: "vulnerability"
aliases: ["CVE-2026-11315"]
title: "dr_libs: crafted MP3 file causes out-of-bounds read in decoder"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["audio", "c", "dr_libs", "mp3-decoding", "package"]
not_affected_if: ["different-version", "no-untrusted-mp3-input"]
published_at: "2026-11-10T16:17:17+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:23:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11315", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# dr_libs: crafted MP3 file causes out-of-bounds read in decoder

Link for people: https://infrastack.ai/live/CVE-2026-11315 (this .md is for agents)

dr_libs is a single-header C audio library, and its dr_mp3 decoder (drmp3_init_internal) mishandles a specially crafted MP3 file, causing an out-of-bounds read. An attacker who gets a malicious MP3 into an application that decodes it can read memory outside the buffer, which may leak data or crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project vendors or depends on dr_libs (search the source tree for `dr_mp3.h`).
- Confirm the version in use is `0.7.3`, the version named by the advisory.

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-11315

## From the sources

A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_