Live › vulnerability › CVE-2026-29508
ReadyMedia (formerly MiniDLNA) 1.3.0 through 1.3.3 has a stack buffer overflow when parsing DFF audio files because an oversized PROP chunk size is trusted without validation. An attacker who places a crafted DFF file in a monitored directory can run code on unprotected builds, or crash the service on builds with stack protections.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 21:35 UTC. All times on this page are UTC.
ReadyMedia (MiniDLNA) 1.3.0 through 1.3.3 is exposed when it monitors a directory an attacker can write a crafted DFF audio file into; inotify then parses the file automatically. This typically means NAS boxes, routers or Linux servers with a writable media share. Systems not running ReadyMedia, or with media folders only trusted users can write to, can skip it. Per the CVE, unprotected builds allow code execution; builds with stack protections crash instead.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| readymedia | vendor | >= 1.3.0, <= 1.3.3 | – |
minidlnad -V or check your package manager: versions 1.3.0 through 1.3.3 are in range (a distro build may carry a backport; check the distro tracker).1.3.3 is the latest release I found)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.
This page as .md · .json · in your agent: get_signal("CVE-2026-29508")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.