Stack-Based Buffer Overflow in SDL_mixer A-IFF Decoder by SDL
CVE-2026-122329

8.5HIGH

Key Information:

Vendor

Libsdl-org

Status
Sdl Mixer
Vendor
CVE Published:
5 November 2026

What is CVE-2026-122329?

Versions 3.1.2 through 3.2.4 of SDL_mixer contain a stack-based buffer overflow in the FetchXLaw() function, located in the AIFF decoder component. This vulnerability arises from miscalculated output offsets when processing A-law or mu-law encoded samples. Attackers can exploit this flaw by supplying a specially crafted AIFF-C file, which may overwrite approximately 1 KB of adjacent stack memory during decoding. This can lead to application crashes or, in certain conditions, the execution of arbitrary code, thereby posing significant security risks.

Affected Version(s)

SDL_mixer 3.1.2 <= 3.2.4

References

https://github.com/libsdl-org/SDL_mixer/issues/907
issue-tracking
https://github.com/libsdl-org/SDL_mixer/commit/34486847a6...
patch
https://github.com/libsdl-org/SDL_mixer/blob/release-3.2....
technical-description

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
Ryan C. Gordon
.