Stack-Based Buffer Overflow in SDL_mixer WAV Decoder
CVE-2026-122328

8.5HIGH

Key Information:

Vendor

Libsdl-org

Status
Sdl Mixer
Vendor
CVE Published:
5 November 2026

What is CVE-2026-122328?

SDL_mixer versions 3.1.2 to 3.2.4 are affected by a stack-based buffer overflow vulnerability in the FetchXLaw() function, which processes A-law or mu-law encoded WAV files. An attacker can exploit this vulnerability by providing specially crafted WAV files, leading to potential overwriting of adjacent stack memory. This could result in crashes or arbitrary code execution, posing significant risks for affected systems.

Affected Version(s)

SDL_mixer 3.1.2 <= 3.2.4

References

https://github.com/libsdl-org/SDL_mixer/issues/907
issue-tracking
https://github.com/libsdl-org/SDL_mixer/pull/910
patchissue-tracking
https://github.com/libsdl-org/SDL_mixer/commit/df966f698e...
patch

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
Danonii
.