---
id: "CVE-2026-29508"
kind: "vulnerability"
aliases: ["CVE-2026-29508"]
title: "ReadyMedia: crafted DFF audio file overflows stack, enabling remote code execution"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "readymedia", "fixed": [], "affected": ">= 1.3.0, <= 1.3.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["linux", "media-server", "minidlna", "package", "readymedia", "self-hosted"]
not_affected_if: ["no-monitored-directory-writable", "version-outside-1.3.0-1.3.3"]
published_at: "2026-11-02T21:17:31+00:00"
first_seen_at: "2026-11-02T21:35:41+00:00"
updated_at: "2026-11-02T21:38:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29508", "first_seen_at": "2026-11-02T21:35:41+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T21:38:42+00:00"}]
---

# ReadyMedia: crafted DFF audio file overflows stack, enabling remote code execution

ReadyMedia (formerly MiniDLNA) 1.3.0 through 1.3.3 has a stack buffer overflow when parsing DFF audio files because an oversized PROP chunk size is trusted without validation. An attacker who places a crafted DFF file in a monitored directory can run code on unprotected builds, or crash the service on builds with stack protections.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:readymedia affected >= 1.3.0, <= 1.3.3 fixed ?

## How to check

- Run `minidlnad -V` or check your package manager: versions 1.3.0 through 1.3.3 are in range (a distro build may carry a backport; check the distro tracker).
- Open minidlna.conf and list every media_dir path; check who can write to them (SMB/NFS shares, upload paths, local accounts). Exploitation needs the attacker to place a file there.
- Also check if you run ASUS routers (VulnCheck links an ASUS fixed firmware for the RT-AX86U series) or other NAS/router firmware that bundles MiniDLNA; the sources do not confirm other devices.

## Fix

No upstream ReadyMedia fixed version is published in the sources I could read (1.3.3 is the latest release I found). VulnCheck links ASUS fixed firmware for affected ASUS routers. Until a fix: restrict write access to every media_dir.

## Timeline

- 2026-11-02T21:35:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-29508
- 2026-11-02T21:38:42+00:00 analyst — VulnCheck advisory (CNA) read: affects 1.3.0-1.3.3, credit Ivan Racic; references an ASUS fixed-firmware download but no upstream ReadyMedia fixed version is stated and I found no upstream release/commit after 1.3.3. Researcher blog and PoC links not visible in the text I could read; nothing verified.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/readymedia-stack-buffer-overflow-via-dff-parser

## From the sources

ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_