CVE-2026-111164: UADE through 3.05 Out-of-Bounds Read in uade_filemagic via Short Module
UADE through 3.05 contains an out-of-bounds read vulnerability in uadefilemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applications that probe or play it.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using UADE through version 3.05 are exposed when they probe or play attacker-supplied module files. The documented impact is an application crash caused by reading beyond the supplied buffer.
What does an attacker need to exploit it?
An attacker needs to provide a crafted short module file that passes the relevant format-probe bounds checks. User interaction is required for the vulnerable application to process that file.
How can I tell whether my application may be affected?
Review whether it includes UADE version 3.05 or earlier and whether it accepts, probes, or plays untrusted module files. Affected processing reaches uade_filemagic() in amifilemagic.c, where short input can trigger the unsigned buffer-size subtraction wrap.