ReadyMedia: Stack-based buffer overflow in DFF parsing (CVE-2026-29508)

ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability (CVE-2026-29508). The issue arises during the parsing of DFF audio files when an oversized PROP chunk size is provided. This size is used to allocate a variable-length stack array without validation, leading to memory corruption when file data is read into the array.

Impact

Successful exploitation may result in remote code execution (RCE) on systems without stack protections or a denial of service (DoS) on hardened systems. The vulnerability can be triggered automatically when the service parses a DFF file placed in a monitored directory using inotify.

Recommendation

1. Inventory all instances of ReadyMedia/MiniDLNA to determine if versions 1.3.0 through 1.3.3 are in use.
2. Restrict file system write permissions for monitored directories to prevent unauthorized placement of malicious media files.
3. Monitor service logs for unexpected process termination or restarts, which may indicate crash-based exploitation attempts.
4. Apply security updates provided by the vendor once available; currently, upgrading to a version beyond 1.3.3 is required.