SDL_mixer (3.1.2-3.2.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/sdl_mixer-3.1.2-3.2.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 18:22:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSDL_mixer: Stack-based buffer overflow in FetchXLaw() (CVE-2026-122328)https://feed.craftedsignal.io/briefs/2026-11-sdl-mixer-overflow/Thu, 05 Nov 2026 18:22:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-sdl-mixer-overflow/SDL_mixer versions 3.1.2 through 3.2.4 contain a stack-based buffer overflow in the FetchXLaw() function that can be triggered by a malformed WAV file, potentially leading to arbitrary code execution.SDL_mixer versions 3.1.2 through 3.2.4 are vulnerable to a stack-based buffer overflow in the FetchXLaw() function within src/decoder_wav.c. The vulnerability occurs during the decoding of A-law or mu-law encoded WAV files. A crafted input file triggers a doubly-offset float expansion that overwrites approximately 1 KB of adjacent stack memory. Successful exploitation can result in application crashes or arbitrary code execution.

Impact

The vulnerability allows an attacker to cause memory corruption, leading to application instability (crashes) or potential remote code execution depending on the context in which the affected application processes the malicious media file.

Recommendation

  • Inventory applications utilizing SDL_mixer library versions 3.1.2 through 3.2.4.
  • Monitor for applications that load media files from untrusted sources and link against these vulnerable library versions.
  • Patch or update to a non-vulnerable version of SDL_mixer as soon as one is made available by the vendor.
]]>highadvisoryvulnerabilitymemory-corruptionmedia-processing