Out-of-Bounds Read Vulnerability in UADE Music Player
CVE-2026-111164
6.8MEDIUM
What is CVE-2026-111164?
UADE Music Player versions up to 3.05 have a vulnerability in the uade_filemagic() function within amifilemagic.c. This issue arises from the improper handling of unsigned buffer size subtraction, which can lead to an out-of-bounds read. By supplying a carefully crafted short module, an attacker may successfully bypass format probe bounds checks, resulting in attempts to read data beyond allocated buffer limits. Consequently, this can lead to application crashes during file probing or playback, impacting user experience and system stability.
Affected Version(s)
uade 0 <= 3.05
References
CVSS V4
Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology