CVE-2026-29022: dr_libs Buffer Overflow Vulnerability

CVE-2026-29022 Overview

CVE-2026-29022 is a heap buffer overflow vulnerability affecting dr_libs, a popular collection of single-file audio decoding libraries. The vulnerability exists in the drwav__read_smpl_to_metadata_obj() function within dr_wav.h and allows memory corruption when processing maliciously crafted WAV files. The flaw stems from a validation mismatch between two processing passes, enabling attackers to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() function call on untrusted input.

Critical Impact

Successful exploitation allows heap memory corruption via malicious WAV files, potentially leading to arbitrary code execution or application crashes in software using dr_libs for audio processing.

Affected Products

• dr_libs version 0.14.4 and earlier
• Applications using dr_wav.h with metadata parsing enabled
• Software calling drwav_init_*_with_metadata() functions on untrusted WAV files

Discovery Timeline

• 2026-03-03 - CVE-2026-29022 published to NVD
• 2026-03-04 - Last updated in NVD database

Technical Details for CVE-2026-29022

Vulnerability Analysis

The vulnerability resides in the drwav__read_smpl_to_metadata_obj() function responsible for parsing the "smpl" chunk within WAV files. This chunk contains sampler-specific metadata including sample loop information. The root cause is a logic flaw where sampleLoopCount validation occurs in pass 1 but is not consistently enforced during pass 2 processing, creating an exploitable mismatch.

When a malformed WAV file with a crafted "smpl" chunk is processed, the function allocates heap memory based on the validated count from pass 1. However, during pass 2, the function processes loop data unconditionally without rechecking bounds, allowing an attacker to write 36 bytes of controlled data beyond the allocated buffer. This overflow size corresponds to the structure size of a sample loop entry.

Root Cause

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). The core issue lies in the two-pass metadata parsing architecture where security validation in the first pass is not properly synchronized with data processing in the second pass. The sampleLoopCount field is validated to ensure proper allocation sizing, but the subsequent loop iteration processes data without referencing this validated count, creating a classic time-of-check to time-of-use style vulnerability in memory operations.

Attack Vector

Exploitation requires local access and user interaction—a victim must open or process a malicious WAV file using an application that incorporates the vulnerable dr_libs library with metadata parsing enabled. The attack vector is local (AV:L) with low complexity (AC:L), requiring no privileges but necessitating user action to trigger the vulnerability.

An attacker can craft a WAV file with a specially constructed "smpl" chunk where the header indicates one loop count but the actual chunk data contains additional loop entries. When this file is processed via any of the drwav_init_*_with_metadata() family of functions, the heap overflow occurs, potentially corrupting adjacent heap metadata or application data structures.

// Security patch in dr_wav.h - version update reflecting the fix
// Source: https://github.com/mackron/dr_libs/commit/8a7258cc66b49387ad58cc5b81568982a3560d49
 
#define DRWAV_VERSION_MAJOR     0
#define DRWAV_VERSION_MINOR     14
-#define DRWAV_VERSION_REVISION  4
+#define DRWAV_VERSION_REVISION  5
#define DRWAV_VERSION_STRING    DRWAV_XSTRINGIFY(DRWAV_VERSION_MAJOR) "." DRWAV_XSTRINGIFY(DRWAV_VERSION_MINOR) "." DRWAV_XSTRINGIFY(DRWAV_VERSION_REVISION)

#include <stddef.h> /* For size_t. */

Source: GitHub Commit Update

Detection Methods for CVE-2026-29022

Indicators of Compromise

• Application crashes or segmentation faults when processing WAV files with unusual "smpl" chunk structures
• Heap corruption detection alerts from memory sanitizers (ASan, Valgrind) during WAV file parsing
• Unexpected termination of audio processing applications after loading specific WAV files

Detection Strategies

• Deploy memory protection tools like AddressSanitizer (ASan) in development and testing environments to catch heap overflows
• Implement file integrity monitoring for WAV files in media processing pipelines
• Use static analysis tools to identify applications linking against vulnerable dr_libs versions (0.14.4 and earlier)
• Monitor for anomalous memory allocation patterns in audio processing applications

Monitoring Recommendations

• Enable heap corruption detection mechanisms in production audio processing services
• Implement logging for metadata parsing failures in applications using dr_libs
• Set up alerting for application crashes correlated with WAV file processing operations
• Review application dependencies regularly to identify usage of vulnerable dr_libs versions

How to Mitigate CVE-2026-29022

Immediate Actions Required

• Update dr_libs to version 0.14.5 or later which includes commit 8a7258c with the security fix
• Audit applications and dependencies for usage of vulnerable dr_libs versions
• Implement input validation for WAV files from untrusted sources before processing
• Consider disabling metadata parsing via standard drwav_init_*() functions (without metadata) if metadata is not required

Patch Information

The vulnerability has been fixed in commit 8a7258cc66b49387ad58cc5b81568982a3560d49. The fix ensures consistent validation of sampleLoopCount across both parsing passes, preventing the mismatch that enables the overflow. Organizations using dr_libs should update to the patched version by pulling the latest code from the official repository or updating to version 0.14.5+.

For detailed technical information, refer to the GitHub Issue Discussion and the Marlink Cyber Security Advisory.

Workarounds

• Restrict WAV file processing to trusted sources only until patching is complete
• Use the non-metadata initialization functions (drwav_init(), drwav_init_file(), drwav_init_memory()) instead of drwav_init_*_with_metadata() variants
• Implement WAV file pre-validation to check "smpl" chunk integrity before processing
• Deploy application sandboxing to limit the impact of potential heap corruption exploitation

# Verify dr_libs version and update to patched commit
# Check current version in dr_wav.h header
grep "DRWAV_VERSION_REVISION" dr_wav.h

# Update to patched version
git fetch origin
git checkout 8a7258cc66b49387ad58cc5b81568982a3560d49
# Or update to latest main branch
git pull origin main