{"id":"CVE-2026-11316","kind":"vulnerability","aliases":["CVE-2026-11316"],"related":[],"title":"dr_libs: crafted WAV file triggers out-of-bounds write in cue parsing","description":"A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.","summary":"dr_wav in dr_libs 0.14.5 has an out-of-bounds write in drwav__read_cue_to_metadata_obj (cue metadata parsing). A crafted .wav file can corrupt memory in the program that parses it. The cue metadata is only parsed when the app opens files with metadata enabled (DRWAV_WITH_METADATA), as I read the dr_wav header; I did not confirm this against the code.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dr_wav","fixed":[],"affected":"0.14.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["audio","c","c++","dr_libs","dr_wav","package","untrusted-file-parsing"],"not_affected_if":["dr_libs-not-used","trusted-input-only"],"how_to_check":"Search your source and vendored code for dr_wav.h and check DRWAV_VERSION_STRING (0.14.5 is the version named as affected). Check whether you open files with drwav_init_*_with_metadata or pass DRWAV_WITH_METADATA; if you do not, the cue parsing is likely not reached (unconfirmed). Also check older vendored copies.","fix":"unknown: dr_wav 0.14.6 (tagged 2026-10-30) is the newest release, but no source links it to this CVE. Check its commits before relying on it.","status":"open","published_at":"2026-11-10T16:17:17+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:23:19+00:00","updated_at":"2026-11-10T16:26:30+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T16:23:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"dr_libs: crafted WAV file triggers out-of-bounds write in cue parsing","impact":"high","summary":"dr_libs' dr_wav decoder has an out-of-bounds write in drwav__read_cue_to_metadata_obj when it reads a crafted .wav file. An attacker who supplies a malicious WAV file can corrupt memory, which may lead to code execution in the program that parses it.","audience":"developers","category":"package","nicknames":[],"who_cares":["c","c++","dr_libs","audio"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"memory corruption in the parsing program, possibly code execution","analyst_note":"Confirm the fixed version and whether the cue-metadata path is reachable by default; check the NVD entry and the dr_libs repository.","how_to_check":"- Check whether your project depends on dr_libs (look for `dr_wav.h` or `dr_libs` in the source tree or vendored code).\n- Check the version in use; the sources name version `0.14.5` as affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","dr_libs-not-used"],"who_is_affected":"Programs that compile in dr_libs' dr_wav decoder and parse .wav files from untrusted sources are exposed. Applications that only play local, trusted audio files are at lower risk. The sources do not name a fixed version.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4573,"output_tokens":549,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the cue-metadata path is reachable by default; check the NVD entry and the dr_libs repository.","search":"'-11316':17A,20A '-2026':16A,19A '0.14.5':40B,127C 'app':79B 'attack':143C 'audio':23B 'bound':10A,46B,107C,140C 'c':24B,25B 'code':102B 'confirm':98B 'corrupt':63B 'craft':3A,59B,130C 'cue':13A,51B,55B,72B,117C 'cve':15A,18A 'dr':1A,21A,26B,28B,35B,38B,92B,113C,123C 'drwav':49B,85B,115C 'enabl':84B 'exist':110C 'file':5A,33B,61B,81B,132C,148C 'function':121C 'header':94B 'lead':134C 'lib':2A,27B,39B,124C 'malici':147C 'memori':64B 'metadata':53B,56B,73B,83B,87B,119C 'obj':54B,120C 'open':80B 'out-of-bound':7A,43B,104C,137C 'packag':30B 'pars':14A,34B,57B,69B,76B 'program':67B 'provid':145C 'read':50B,90B,116C 'special':129C 'trigger':6A,150C 'untrust':32B 'untrusted-file-pars':31B 'version':125C 'vulner':109C,152C 'wav':4A,22A,29B,36B,60B,93B,114C,131C 'write':11A,47B,108C,141C","nicknames":[],"mitigations":[],"who_affected":"Programs that compile in dr_libs' dr_wav decoder and parse .wav files from untrusted sources are exposed. Applications that only play local, trusted audio files are at lower risk. The sources do not name a fixed version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["drwav"],"ptokens":["dr","wav"],"labels":["audio","c","drlibs","drwav","high","package","untrustedfileparsing"],"campaign_type":null,"search_a":"'-11316':17A,20A '-2026':16A,19A 'bound':10A 'craft':3A 'cue':13A 'cve':15A,18A 'dr':1A,21A 'file':5A 'lib':2A 'out-of-bound':7A 'pars':14A 'trigger':6A 'wav':4A,22A 'write':11A","search_b":"'0.14.5':40B 'app':79B 'audio':23B 'bound':46B 'c':24B,25B 'code':102B 'confirm':98B 'corrupt':63B 'craft':59B 'cue':51B,55B,72B 'dr':26B,28B,35B,38B,92B 'drwav':49B,85B 'enabl':84B 'file':33B,61B,81B 'header':94B 'lib':27B,39B 'memori':64B 'metadata':53B,56B,73B,83B,87B 'obj':54B 'open':80B 'out-of-bound':43B 'packag':30B 'pars':34B,57B,69B,76B 'program':67B 'read':50B,90B 'untrust':32B 'untrusted-file-pars':31B 'wav':29B,36B,60B,93B 'write':47B","search_c":"'0.14.5':127C 'attack':143C 'bound':107C,140C 'craft':130C 'cue':117C 'dr':113C,123C 'drwav':115C 'exist':110C 'file':132C,148C 'function':121C 'lead':134C 'lib':124C 'malici':147C 'metadata':119C 'obj':120C 'out-of-bound':104C,137C 'provid':145C 'read':116C 'special':129C 'trigger':150C 'version':125C 'vulner':109C,152C 'wav':114C,131C 'write':108C,141C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11316","severity":null,"published_at":"2026-11-10T16:17:17+00:00","modified_at":"2026-11-10T16:17:17+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-11316:2469","url":"https://github.com/mackron/dr_libs/tags","severity":null,"published_at":"2026-11-10T16:26:30+00:00","modified_at":"2026-11-10T16:26:30+00:00","first_seen_at":"2026-11-10T16:26:30+00:00","fetched_at":"2026-11-10T16:26:30+00:00","note":"NVD/OpenCVE text only: OOB write in drwav__read_cue_to_metadata_obj, dr_libs 0.14.5, CVSS 3.1 8.8. No maintainer advisory or issue found naming this CVE. dr_wav 0.14.6 was tagged 2026-10-30 (after 0.14.5 of 2026-03-02) and likely carries metadata fixes, but I found no source tying it to this CVE, so fix is not confirmed. Related but separate: CVE-2026-71261 (W64 CUE, 32-bit). Nothing verified; the primary source is missing. To settle: dr_wav 0.14.6 changelog or the commit that fixes drwav__read_cue_to_metadata_obj.","cites":["https://github.com/mackron/dr_libs/tags","https://app.opencve.io/cve/CVE-2026-11316"]}],"documents":[{"id":116255,"url":"https://github.com/mackron/dr_libs/tags","title":"mackron/dr_libs tags (wav-0.14.5, wav-0.14.6)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":116256,"url":"https://app.opencve.io/cve/CVE-2026-11316","title":"CVE-2026-11316 - OpenCVE (NVD description)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}