Medium 6.2Published Mar 17, 2026

CVE-2026-32836mackron / dr_libs dr_flac.h Excessive Memory Allocation in PICTURE Metadata Parsing

Updated under an hour ago (Oct 27, 2026, 4:50 PM ET)

Does this affect you?

It affects mackron dr_libs dr_flac.h and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for mackron dr_libs dr_flac.h

Exploited in the last 30 days

dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vulnerability in drflac__read_and_decode_metadata() that allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can exploit attacker-controlled mimeLength and descriptionLength fields to cause denial of service through memory exhaustion when processing FLAC streams with metadata callbacks.

CVSS: 6.2 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-789
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Modified
Record last updated: Jul 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

mackron dr_libs dr_flac.h mackron:dr_libs_dr_flac.h (from the name)	through 0.13.3; fefced4a64adfb1a68a2d31d882366e56096dee8 not affected; 4f5a4cd3b57564d969443c580c75857e039f100a not affected; 663239a3d0460c33bd5b6e5166edcb404e3df676 not affected	CNA record
mackron dr_libs mackron:dr_libs	through 0.13.3	NVD

References

References

https://github.com/mackron/dr_libs/issues/298	issue-tracking, exploit, mitigation, vendor-advisory
https://github.com/mackron/dr_libs/commit/fefced4a64adfb1a68a2d31d882366e56096dee8	patch
https://github.com/mackron/dr_libs/commit/4f5a4cd3b57564d969443c580c75857e039f100a	patch
https://github.com/mackron/dr_libs/commit/663239a3d0460c33bd5b6e5166edcb404e3df676	patch
https://www.vulncheck.com/advisories/mackron-dr-libs-excessive-memory-allocation-in-picture-metadata-parsing	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.