---
id: "CVE-2026-11316"
page: "https://infrastack.ai/live/CVE-2026-11316"
kind: "vulnerability"
aliases: ["CVE-2026-11316"]
title: "dr_libs: crafted WAV file triggers out-of-bounds write in cue parsing"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "dr_wav", "fixed": [], "affected": "0.14.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["audio", "c", "c++", "dr_libs", "dr_wav", "package", "untrusted-file-parsing"]
not_affected_if: ["dr_libs-not-used", "trusted-input-only"]
published_at: "2026-11-10T16:17:17+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:26:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11316", "first_seen_at": "2026-11-10T16:22:33+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-11316", "first_seen_at": "2026-11-10T16:26:30+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-11316", "https://github.com/mackron/dr_libs/tags"]}]
exploit_sources: []
---

# dr_libs: crafted WAV file triggers out-of-bounds write in cue parsing

Link for people: https://infrastack.ai/live/CVE-2026-11316 (this .md is for agents)

dr_wav in dr_libs 0.14.5 has an out-of-bounds write in drwav__read_cue_to_metadata_obj (cue metadata parsing). A crafted .wav file can corrupt memory in the program that parses it. The cue metadata is only parsed when the app opens files with metadata enabled (DRWAV_WITH_METADATA), as I read the dr_wav header; I did not confirm this against the code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:dr_wav affected 0.14.5 fixed no fixed version listed

## How to check

Search your source and vendored code for dr_wav.h and check DRWAV_VERSION_STRING (0.14.5 is the version named as affected). Check whether you open files with drwav_init_*_with_metadata or pass DRWAV_WITH_METADATA; if you do not, the cue parsing is likely not reached (unconfirmed). Also check older vendored copies.

## Fix

unknown: dr_wav 0.14.6 (tagged 2026-10-30) is the newest release, but no source links it to this CVE. Check its commits before relying on it.

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-11316
- 2026-11-10T16:26:30+00:00 analyst https://app.opencve.io/cve/CVE-2026-11316 — NVD/OpenCVE text only: OOB write in drwav__read_cue_to_metadata_obj, dr_libs 0.14.5, CVSS 3.1 8.8. No maintainer advisory or issue found naming this CVE. dr_wav 0.14.6 was tagged 2026-10-30 (after 0.14.5 of 2026-03-02) and likely carries metadata fixes, but I found no source tying it to this CVE, so fix is not confirmed. Related but separate: CVE-2026-71261 (W64 CUE, 32-bit). Nothing verified; the primary source is missing. To settle: dr_wav 0.14.6 changelog or the commit that fixes drwav__read_cue_to_metadata_obj.

## Documents

- [describes] CVE-2026-11316 - OpenCVE (NVD description) https://app.opencve.io/cve/CVE-2026-11316
- [mentions] mackron/dr_libs tags (wav-0.14.5, wav-0.14.6) https://github.com/mackron/dr_libs/tags

## From the sources

A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_