DEBIAN-CVE-2026-122328: Buffer Overflow

Published Nov 5, 2026

Updated

SDLmixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoderwav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Affected Software

1 affected component

debian/libsdl3-mixer*

Event History

Nov 5, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What would an attacker need to exploit this issue?

An attacker would need to provide a crafted A-law or mu-law WAV file and have it decoded by the affected SDL_mixer code. The malformed file triggers the overflow in FetchXLaw() during WAV decoding.

Who is exposed in practice?

Applications using Debian's libsdl3-mixer package are exposed if they decode attacker-controlled or otherwise untrusted A-law or mu-law WAV files. The affected SDL_mixer versions are 3.1.2 through 3.2.4.

What is the likely impact if exploitation succeeds?

The overflow can overwrite approximately 1 KB of adjacent stack memory. This can cause a crash and may potentially allow code execution.

DEBIAN-CVE-2026-122328: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

What would an attacker need to exploit this issue?

Who is exposed in practice?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What would an attacker need to exploit this issue?

Who is exposed in practice?

What is the likely impact if exploitation succeeds?