{"id":"CVE-2026-122329","kind":"vulnerability","aliases":["CVE-2026-122329"],"related":[],"title":"SDL_mixer: crafted AIFF-C file overflows stack, risking code execution","description":"SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution.","summary":"SDL_mixer versions 3.1.2 through 3.2.4 miscalculate output offsets when decoding A-law or mu-law AIFF-C audio, causing a stack buffer overflow in FetchXLaw(). An attacker who supplies a crafted AIFF-C file can overwrite about 1 KB of adjacent stack memory, crashing the app or potentially running code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","c++","games","package","sdl","sdl_mixer"],"not_affected_if":["no-aiff-decoding","other-sdl-mixer-versions","trusted-audio-only"],"how_to_check":"- Check the SDL_mixer version your app links against, for example in your dependency manifest or with `pkg-config --modversion SDL3_mixer` where it is installed.\n- Look for `src/decoder_aiff.c` in vendored copies of SDL_mixer.\n- Check whether your application decodes AIFF-C files from untrusted sources.","fix":"- SDL_mixer: move to a release newer than `3.2.4` (the fixed version is in the linked patch; the sources do not state the exact release number).","status":"open","published_at":"2026-11-05T16:17:46+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","triaged_at":"2026-11-05T16:41:19+00:00","updated_at":"2026-11-05T16:41:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T16:41:19Z","model":"claude-haiku-5-5","output":{"fix":"- SDL_mixer: move to a release newer than `3.2.4` (the fixed version is in the linked patch; the sources do not state the exact release number).","reach":"unknown","title":"SDL_mixer: crafted AIFF-C file overflows stack, risking code execution","impact":"high","summary":"SDL_mixer versions 3.1.2 through 3.2.4 miscalculate output offsets when decoding A-law or mu-law AIFF-C audio, causing a stack buffer overflow in FetchXLaw(). An attacker who supplies a crafted AIFF-C file can overwrite about 1 KB of adjacent stack memory, crashing the app or potentially running code.","audience":"developers","category":"package","nicknames":[],"who_cares":["sdl","sdl_mixer","games","c","c++"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"crashes the app or potentially runs attacker code","analyst_note":"Confirm the exact fixed release number and whether AIFF-C decoding is compiled in by default, using the linked patch on github.com and the NVD entry.","how_to_check":"- Check the SDL_mixer version your app links against, for example in your dependency manifest or with `pkg-config --modversion SDL3_mixer` where it is installed.\n- Look for `src/decoder_aiff.c` in vendored copies of SDL_mixer.\n- Check whether your application decodes AIFF-C files from untrusted sources.","plain_action":"","needs_analyst":true,"not_affected_if":["other-sdl-mixer-versions","no-aiff-decoding","trusted-audio-only"],"who_is_affected":"Applications that link SDL_mixer 3.1.2 through 3.2.4 and decode AIFF-C audio, especially files from users or the network, are exposed. Programs that only play bundled audio you control, or that use other SDL_mixer versions, can skip it. The sources do not say whether the flaw is reachable with default build options.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000793,"input_tokens":4319,"output_tokens":723,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122329':15A,18A '-2026':14A,17A '1':68B,124C '3.1.2':29B,83C '3.2.4':31B,85C 'a-law':37B,104C 'adjac':71B,127C 'aiff':5A,45B,62B,118C 'aiff-c':4A,44B,61B,117C 'app':76B 'attack':56B,112C 'audio':47B 'base':90C 'buffer':51B,91C 'c':6A,19B,20B,46B,63B,119C 'caus':48B,132C 'code':11A,80B,136C 'contain':86C 'craft':3A,60B,116C 'crash':74B,133C 'cve':13A,16A 'decod':36B,131C 'due':97C 'execut':12A,137C 'expand':103C 'fetchxlaw':54B,94C 'file':7A,64B,120C 'game':21B 'kb':69B,125C 'law':39B,43B,106C,110C 'memori':73B,129C 'miscalcul':32B,99C 'mixer':2A,25B,27B,82C 'mu':42B,109C 'mu-law':41B,108C 'offset':34B,101C 'output':33B,100C 'overflow':8A,52B,92C 'overwrit':66B,122C 'packag':22B 'potenti':78B,135C 'risk':10A 'rough':123C 'run':79B 'sampl':111C 'sdl':1A,23B,24B,26B,81C 'src/decoder_aiff.c':96C 'stack':9A,50B,72B,89C,128C 'stack-bas':88C 'suppli':58B,114C 'version':28B","nicknames":[],"mitigations":[],"who_affected":"Applications that link SDL_mixer 3.1.2 through 3.2.4 and decode AIFF-C audio, especially files from users or the network, are exposed. Programs that only play bundled audio you control, or that use other SDL_mixer versions, can skip it. The sources do not say whether the flaw is reachable with default build options.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","games","high","package","sdl","sdlmixer"],"campaign_type":null,"first_public_at":"2026-11-05T16:17:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122329","severity":null,"published_at":"2026-11-05T16:17:46+00:00","modified_at":"2026-11-05T16:17:46+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","fetched_at":"2026-11-05T16:40:02+00:00","note":null}],"documents":[{"id":77634,"url":"https://github.com/libsdl-org/SDL_mixer/commit/34486847a607540ce9ef5fbe20979c7140bf8c82","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77635,"url":"https://www.vulncheck.com/advisories/sdl-mixer-3.1.2-through-3.2.4-stack-based-buffer-overflow-via-fetchxlaw-in-aiff-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}