{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3alibsdlsdl_mixer3.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:libsdl:sdl_mixer:3.1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsdl:sdl_mixer:3.2.4:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-122329"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SDL_mixer (3.1.2 - 3.2.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["LibSDL"],"content_html":"\u003cp\u003eSDL_mixer versions 3.1.2 through 3.2.4 contain a stack-based buffer overflow in the \u003ccode\u003eFetchXLaw()\u003c/code\u003e function located in \u003ccode\u003esrc/decoder_aiff.c\u003c/code\u003e. The vulnerability stems from an incorrect calculation of output offsets when processing A-law or mu-law audio samples within AIFF-C files. Successful exploitation allows an attacker to overwrite approximately 1 KB of adjacent stack memory, which can lead to application crashes or potential arbitrary code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may result in an application crash (Denial of Service) or potential arbitrary code execution depending on the memory layout and the presence of exploit mitigation protections within the host application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all applications utilizing SDL_mixer library versions 3.1.2 through 3.2.4.\u003c/li\u003e\n\u003cli\u003ePrioritize upgrading to the latest patched version of SDL_mixer once available.\u003c/li\u003e\n\u003cli\u003eImplement memory safety protections (e.g., stack canaries, DEP, ASLR) at the build or runtime level for applications that process untrusted AIFF-C audio files.\u003c/li\u003e\n\u003cli\u003ePerform input validation or sandboxing for applications that handle AIFF-C files from external, untrusted sources.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-05T18:22:27Z","date_published":"2026-11-05T18:22:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-sdl-mixer-overflow-4b26a28c/","summary":"SDL_mixer versions 3.1.2 through 3.2.4 are vulnerable to a stack-based buffer overflow in the FetchXLaw function that can be triggered by malicious AIFF-C files.","title":"SDL_mixer: Stack-based buffer overflow in FetchXLaw (CVE-2026-122329)","url":"https://feed.craftedsignal.io/briefs/2026-11-sdl-mixer-overflow-4b26a28c/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:libsdl:sdl_mixer:3.1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsdl:sdl_mixer:3.2.4:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-122328"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SDL_mixer (3.1.2-3.2.4)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","memory-corruption","media-processing"],"_cs_type":"advisory","_cs_vendors":["Simple DirectMedia Layer"],"content_html":"\u003cp\u003eSDL_mixer versions 3.1.2 through 3.2.4 are vulnerable to a stack-based buffer overflow in the FetchXLaw() function within src/decoder_wav.c. The vulnerability occurs during the decoding of A-law or mu-law encoded WAV files. A crafted input file triggers a doubly-offset float expansion that overwrites approximately 1 KB of adjacent stack memory. Successful exploitation can result in application crashes or arbitrary code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an attacker to cause memory corruption, leading to application instability (crashes) or potential remote code execution depending on the context in which the affected application processes the malicious media file.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory applications utilizing SDL_mixer library versions 3.1.2 through 3.2.4.\u003c/li\u003e\n\u003cli\u003eMonitor for applications that load media files from untrusted sources and link against these vulnerable library versions.\u003c/li\u003e\n\u003cli\u003ePatch or update to a non-vulnerable version of SDL_mixer as soon as one is made available by the vendor.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T18:22:20Z","date_published":"2026-11-05T18:22:20Z","id":"https://feed.craftedsignal.io/briefs/2026-11-sdl-mixer-overflow/","summary":"SDL_mixer versions 3.1.2 through 3.2.4 contain a stack-based buffer overflow in the FetchXLaw() function that can be triggered by a malformed WAV file, potentially leading to arbitrary code execution.","title":"SDL_mixer: Stack-based buffer overflow in FetchXLaw() (CVE-2026-122328)","url":"https://feed.craftedsignal.io/briefs/2026-11-sdl-mixer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:libsdl:sdl_mixer:3.1.2:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}