Heap Buffer Overflow in dr_libs Affects WAV File Processing
CVE-2026-29022

6.8MEDIUM

Key Information:

Vendor

Mackron

Status
Dr Libs Dr Wav.h
Vendor
CVE Published:
3 March 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-29022?

The dr_libs library, specifically versions up to 0.14.4, is susceptible to a heap buffer overflow due to improper validation within the drwav__read_smpl_to_metadata_obj() function. This vulnerability arises when processing crafted WAV files, leading to potential memory corruption. Exploitation occurs due to a mismatch in sampleLoopCount validation during the handling of input data, allowing attackers to control heap memory allocations. Users are advised to update to the latest version to mitigate this risk.

Affected Version(s)

dr_libs dr_wav.h 0 <= 0.14.4

dr_libs dr_wav.h 8a7258cc66b49387ad58cc5b81568982a3560d49

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-29022 - Proof of Concept

References

https://github.com/marlinkcyber/advisories/blob/main/advi...
technical-descriptionexploit
https://github.com/mackron/dr_libs/issues/296
issue-tracking
https://github.com/mackron/dr_libs/commit/8a7258cc66b4938...
patch

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ana Kapulica
.