CVE-2026-122329: SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder
SDLmixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoderaiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution.
Event History
Frequently Asked Questions
What must an attacker provide to trigger the overflow?
An attacker must cause the application to decode a crafted AIFF-C file containing A-law or mu-law samples. The vulnerable FetchXLaw() path miscalculates output offsets while expanding those samples.
Is user interaction required for exploitation?
Yes. The supplied vector specifies user interaction is required, so exploitation depends on a user or application workflow that opens or decodes the attacker-controlled AIFF-C file.
Which SDL_mixer versions are affected?
SDL_mixer versions 3.1.2 through 3.2.4 are identified as affected.
What could happen if a vulnerable application decodes a malicious file?
The overflow can overwrite roughly 1 KB of adjacent stack memory. This may crash the application or potentially allow code execution.