# CVE-2026-32837

## Summary

- **CVE ID:** CVE-2026-32837
- **Severity:** MEDIUM
- **CVSS Score:** 5.1 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
- **CWE:** CWE-170
- **Published:** Mar 17, 2026
- **Last Modified:** Jul 14, 2026

## Description

miniaudio version 0.11.25 and earlier contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.

## Affected Products

- mackron — miniaudio (0)
- mackron — miniaudio (1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde)

## References

- [CNA](https://github.com/mackron/miniaudio/issues/1101)
- [CNA](https://www.vulncheck.com/advisories/mackron-miniaudio-out-of-bounds-read-in-bext-coding-history-parsing)
- [CNA](https://github.com/mackron/miniaudio/commit/1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde)
- [CNA](https://github.com/mackron/dr_libs/commit/04e40d66a7ba1632f93ec1328d4b42ad986e3ee0)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.22%
- **EPSS Percentile:** 13.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._