HIGH 8.5 NVD
CVE-2026-122329
SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-l
SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution.
References
- https://github.com/libsdl-org/SDL_mixer
- https://github.com/libsdl-org/SDL_mixer/blob/release-3.2.4/src/decoder_aiff.c#L535-536
- https://github.com/libsdl-org/SDL_mixer/blob/release-3.2.4/src/decoder_aiff.c#L86-97
- https://github.com/libsdl-org/SDL_mixer/commit/34486847a607540ce9ef5fbe20979c7140bf8c82
- https://github.com/libsdl-org/SDL_mixer/issues/907
This high severity vulnerability with a CVSS score of 8.5 was published on 2026-11-05 via NVD.
vulnfeed aggregates 16740 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.