Integer Overflow Vulnerability in W64 WAV Metadata Parsing in dr_libs

CVE-2026-71261

What is CVE-2026-71261?

The vulnerability in dr_libs’ dr_wav.h arises from an integer overflow during the parsing of W64 CUE chunk metadata. This flaw occurs as the library improperly truncates the 64-bit W64 chunk size to a size_t type, which can lead to incorrect calculations when managing metadata capacity. Due to insufficient validation of the cuePointCount field, an attacker can exploit this vulnerability by crafting a specific W64 WAV file. Such an attack could result in a heap buffer overflow in 32-bit applications that process untrusted WAV metadata, potentially allowing arbitrary code execution or denial of service.

References