{"id":"CVE-2026-122328","kind":"vulnerability","aliases":["CVE-2026-122328"],"related":[],"title":"SDL_mixer: crafted WAV file overflows stack when decoding audio","description":"SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.","summary":"SDL_mixer's WAV decoder, in FetchXLaw() for A-law and mu-law files, writes about 1 KB past a stack buffer when given a crafted file. An attacker who gets an application to play such a WAV can crash it or possibly run code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","c++","games","package","sdl_mixer"],"not_affected_if":["only-trusted-audio-files","sdl-mixer-outside-3.1.2-3.2.4"],"how_to_check":"- Find the SDL_mixer version in use, for example with `pkg-config --modversion SDL3_mixer` or in the project's lockfile or vendored sources.\n- Check whether the application decodes WAV files from untrusted sources.","fix":"- SDL_mixer versions after `3.2.4` (the fixed release is named in the patch linked from the NVD entry; the exact version is unknown from the sources).","status":"open","published_at":"2026-11-05T16:17:45+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","triaged_at":"2026-11-05T16:41:23+00:00","updated_at":"2026-11-05T16:41:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T16:41:23Z","model":"claude-haiku-5-5","output":{"fix":"- SDL_mixer versions after `3.2.4` (the fixed release is named in the patch linked from the NVD entry; the exact version is unknown from the sources).","reach":"unknown","title":"SDL_mixer: crafted WAV file overflows stack when decoding audio","impact":"high","summary":"SDL_mixer's WAV decoder, in FetchXLaw() for A-law and mu-law files, writes about 1 KB past a stack buffer when given a crafted file. An attacker who gets an application to play such a WAV can crash it or possibly run code.","audience":"developers","category":"package","nicknames":[],"who_cares":["sdl_mixer","games","c","c++"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Crash, or code runs in the affected application when it plays a crafted WAV.","analyst_note":"Confirm the fixed SDL_mixer version from the linked patch and the exact A-law/mu-law trigger conditions; the sources do not give the fixed version number.","how_to_check":"- Find the SDL_mixer version in use, for example with `pkg-config --modversion SDL3_mixer` or in the project's lockfile or vendored sources.\n- Check whether the application decodes WAV files from untrusted sources.","plain_action":"","needs_analyst":true,"not_affected_if":["sdl-mixer-outside-3.1.2-3.2.4","only-trusted-audio-files"],"who_is_affected":"Applications that link SDL_mixer 3.1.2 through 3.2.4 and decode A-law or mu-law WAV files, especially files that come from users or the network. Programs that only play bundled audio they control are much less exposed. Check whether any input path reaches the WAV decoder before deciding how urgent this is.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4309,"output_tokens":651,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122328':13A,16A '-2026':12A,15A '1':41B,113C '3.1.2':72C '3.2.4':74C 'a-law':31B,89C 'adjac':116C 'applic':57B 'attack':53B,98C 'audio':10A 'base':79C 'buffer':46B,80C 'c':17B,18B 'caus':119C 'code':69B,123C 'contain':75C 'craft':3A,50B,102C 'crash':64B,120C 'cve':11A,14A 'decod':9A,27B,88C 'doubli':107C 'doubly-offset':106C 'execut':124C 'expans':110C 'fetchxlaw':29B,84C 'file':5A,38B,51B,97C,104C 'float':109C 'game':19B 'get':55B 'given':48B 'kb':42B,114C 'law':33B,37B,91C,95C 'memori':118C 'mixer':2A,22B,24B,71C 'mu':36B,94C 'mu-law':35B,93C 'offset':108C 'overflow':6A,81C 'overwrit':111C 'packag':20B 'past':43B 'play':59B 'possibl':67B 'potenti':122C 'run':68B 'sdl':1A,21B,23B,70C 'src/decoder_wav.c':86C 'stack':7A,45B,78C,117C 'stack-bas':77C 'suppli':100C 'vulner':82C 'wav':4A,26B,62B,96C,103C 'whose':105C 'write':39B","nicknames":[],"mitigations":[],"who_affected":"Applications that link SDL_mixer 3.1.2 through 3.2.4 and decode A-law or mu-law WAV files, especially files that come from users or the network. Programs that only play bundled audio they control are much less exposed. Check whether any input path reaches the WAV decoder before deciding how urgent this is.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","games","high","package","sdlmixer"],"campaign_type":null,"first_public_at":"2026-11-05T16:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122328","severity":null,"published_at":"2026-11-05T16:17:45+00:00","modified_at":"2026-11-05T16:17:45+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","fetched_at":"2026-11-05T16:40:02+00:00","note":null}],"documents":[{"id":77632,"url":"https://github.com/libsdl-org/SDL_mixer/commit/df966f698e18ae849bd92796a26311e79c555718","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77633,"url":"https://www.vulncheck.com/advisories/sdl-mixer-3.1.2-through-3.2.4-stack-based-buffer-overflow-via-fetchxlaw-in-wav-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}