CVE-2026-122328 · Package
NO FIX YET · SEE WHAT TO DO
SDL_mixer's WAV decoder, in FetchXLaw() for A-law and mu-law files, writes about 1 KB past a stack buffer when given a crafted file. An attacker who gets an application to play such a WAV can crash it or possibly run code.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that link SDL_mixer 3.1.2 through 3.2.4 and decode A-law or mu-law WAV files, especially files that come from users or the network. Programs that only play bundled audio they control are much less exposed. Check whether any input path reaches the WAV decoder before deciding how urgent this is.
Not affected if only-trusted-audio-files, sdl-mixer-outside-3.1.2-3.2.4
Who cares c, c++, games, sdl_mixer
pkg-config --modversion SDL3_mixer or in the project's lockfile or vendored sources.3.2.4 (the fixed release is named in the patch linked from the NVD entry; the exact version is unknown from the sources).SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.