CVE-2026-71261 Overview
CVE-2026-71261 is an integer overflow vulnerability in dr_libsdr_wav.h, a widely used single-file C/C++ header library for decoding WAV audio. The flaw resides in W64 CUE chunk metadata parsing and affects all versions through the current master branch. On 32-bit builds, a crafted W64 WAV file causes a heap buffer overflow during metadata parsing. The vulnerability is classified under CWE-190: Integer Overflow or Wraparound.
Critical Impact
Attackers can trigger a heap buffer overflow in any 32-bit application that parses untrusted WAV metadata using dr_wav, enabling potential arbitrary code execution.
Affected Products
- dr_libsdr_wav.h — all versions through current master
- Any 32-bit application or library statically embedding dr_wav.h
- Release builds compiled with -DNDEBUG where DRWAV_ASSERT compiles to a no-op
Discovery Timeline
- 2026-08-05 - CVE-2026-71261 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71261
Vulnerability Analysis
The vulnerability exists in the W64 CUE chunk metadata parsing pipeline of dr_wav.h. In drwav__metadata_process_chunk(), a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES. On 32-bit builds, this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.
The subsequent call to drwav__read_cue_to_metadata_obj() computes the actual cue point count and allocation size using the full-precision, attacker-controlled cuePointCount field. The function does not cross-check this value against the stage-1 capacity estimate. The only bounds enforcement on the resulting memory region inside drwav__metadata_get_memory() is a DRWAV_ASSERT, which compiles to a no-op under -DNDEBUG, the default for release builds.
Root Cause
The root cause is a numeric truncation error [CWE-190] between two stages of parsing. Stage 1 truncates a 64-bit size field to a 32-bit size_t, producing an undersized allocation. Stage 2 trusts the attacker-controlled cuePointCount without validation. The assertion-only bounds check disappears in release builds, leaving the out-of-bounds write unmitigated.
Attack Vector
An attacker supplies a crafted W64 WAV file with a sizeInBytes value chosen to induce truncation and a cuePointCount sized to overflow the resulting heap buffer. User interaction is required because a victim must open or process the malicious file. Exploitation is local: any 32-bit application ingesting untrusted WAV metadata (media players, converters, game engines, DAWs) becomes a target.
The vulnerability manifests during metadata processing after the truncated capacity is used to allocate the extra metadata region. Subsequent cue point writes exceed the allocated buffer, corrupting adjacent heap memory. See the GitHub dr_wav Header File for the affected parsing routines.
Detection Methods for CVE-2026-71261
Indicators of Compromise
- W64 WAV files with abnormally large cuePointCount values relative to the declared CUE chunk sizeInBytes
- Crashes or heap corruption reports in 32-bit processes shortly after opening WAV files from untrusted sources
- Unexpected child process creation or memory anomalies in media parsing applications
Detection Strategies
- Perform static analysis of software inventories to identify binaries statically linking dr_wav.h, particularly 32-bit builds
- Deploy file-format validation at the perimeter to reject W64 WAV files with mismatched CUE chunk size and cue point count fields
- Instrument fuzzing harnesses with AddressSanitizer against drwav__metadata_process_chunk() to surface heap overflows in test environments
Monitoring Recommendations
- Monitor endpoints for process crashes in audio and multimedia applications that consume external WAV files
- Log and alert on WAV files delivered via email, web downloads, or removable media that fail schema validation
- Track memory-corruption telemetry from 32-bit desktop applications, which remain the primary risk surface
How to Mitigate CVE-2026-71261
Immediate Actions Required
- Rebuild affected applications as 64-bit where feasible to eliminate the size_t truncation path
- Enable heap hardening features (ASLR, heap metadata protection, CFG) on hosts running vulnerable 32-bit binaries
- Restrict processing of WAV files from untrusted sources until the upstream library is patched
- Compile release builds without -DNDEBUG in high-risk parsers so DRWAV_ASSERT remains active as a defense
Patch Information
No official patch is referenced in the CVE record at the time of publication. Monitor the dr_libs GitHub repository for upstream fixes and apply them to any vendored copies of dr_wav.h. Applications embedding the header must rebuild after updating.
Workarounds
- Add pre-parse validation that rejects W64 CUE chunks where cuePointCount * DRWAV_CUE_POINT_BYTES exceeds the declared chunk sizeInBytes
- Replace DRWAV_ASSERT in bounds checks with runtime error returns that abort parsing on violation
- Sandbox WAV parsing in a least-privilege process to contain heap corruption if exploitation occurs
- Prefer 64-bit builds of applications that must process untrusted WAV metadata
# Example: rebuild with assertions enabled and 64-bit target
gcc -m64 -O2 -UNDEBUG -o wavparser wavparser.c
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
