DEBIAN-CVE-2026-122329: Buffer Overflow

Published Nov 5, 2026

Updated

SDLmixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoderaiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution.

Affected Software

1 affected component

debian/libsdl3-mixer*

Event History

Nov 5, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which upstream SDL_mixer versions are identified as affected?

The issue is reported in SDL_mixer versions 3.1.2 through 3.2.4.

Is exploitation limited to a denial of service?

No. Decoding a crafted AIFF-C file can cause crashes and may permit code execution because adjacent stack memory can be overwritten.

DEBIAN-CVE-2026-122329: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which upstream SDL_mixer versions are identified as affected?

Is exploitation limited to a denial of service?

Company

Resources

Contact

Frequently Asked Questions

Which upstream SDL_mixer versions are identified as affected?

Is exploitation limited to a denial of service?