CVE-2026-29508: Buffer Overflow
ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs the ability to place a crafted DFF audio file in a directory monitored by ReadyMedia. The malicious file must contain an oversized PROP chunk size value, and exploitation is triggered when ReadyMedia automatically parses the file through inotify.
Are default deployments exposed to remote attack?
Exposure depends on whether an attacker can write or otherwise cause a crafted DFF file to appear in a monitored media directory. The described attack does not require user interaction, but it does require that file-placement capability.
What is the likely impact if the service processes a malicious file?
On builds without effective stack protections, the stack overflow may allow remote code execution. On hardened builds with stack protections, the expected impact is denial of service.
How can I determine whether a system is affected?
Check whether the system runs ReadyMedia/MiniDLNA version 1.3.0 through 1.3.3 and monitors directories that could receive DFF audio files from untrusted or remotely writable sources. Ubuntu and Debian MiniDLNA packages are identified as affected software in the available data.