Security readout for executives and security teams
Plain-English summary
CVE-2026-29022 is a high-severity memory corruption flaw in the dr_wav.h audio parser. Software that embeds affected dr_libs code and opens untrusted WAV files could crash or corrupt memory when processing crafted metadata. The bundle does not show active exploitation, but the attack path is realistic for file-handling applications.
Executive priority
Prioritize remediation for software that accepts WAV files from users, partners, or the internet. This is not proven actively exploited in the provided sources, but memory corruption in file parsers can affect availability and integrity and is often hard to detect after deployment.
Technical view
dr_wav.h 0.14.4 and earlier contain a heap buffer overflow in drwav__read_smpl_to_metadata_obj(). Sources describe inconsistent sampleLoopCount handling between metadata sizing and processing passes, allowing crafted WAV metadata to overflow heap allocations through drwav_init_*_with_metadata() on untrusted input.
Likely exposure
Exposure is most likely in products that vendor dr_wav.h directly and parse user-supplied WAV files with metadata enabled. Header-only library copies may be missed by normal dependency inventory. Network exposure depends on the embedding application, such as upload, conversion, media, or desktop file-open workflows.
Exploitation context
The CVSS vector requires local interaction and user action, consistent with opening or processing a malicious WAV file. The source bundle marks KEV as false and provides no evidence of active exploitation. One reference is tagged exploit, so proof-of-concept details may exist publicly.
Researcher notes
The key condition is metadata parsing of crafted smpl chunks. Sources attribute the overflow to pass-one validation not matching pass-two processing. Validate exposure by source review and patched commit comparison. Do not assume all dr_libs consumers are affected unless they include the vulnerable header and reachable metadata APIs.
Mitigation direction
- Update vendored dr_wav.h to commit 8a7258c or later vendor guidance.
- Audit all embedded or copied dr_libs headers, not only package manifests.
- Avoid metadata parsing for untrusted WAV files until patched.
- Sandbox audio parsing paths and enforce resource limits where feasible.
- Add regression coverage for malformed WAV metadata handling.
Validation and detection
- Locate every dr_wav.h copy and identify its upstream version or commit.
- Confirm patched copies include commit 8a7258cc66b49387ad58cc5b81568982a3560d49.
- Review whether drwav_init_*_with_metadata() handles untrusted files.
- Check file-upload, conversion, and preview paths for WAV metadata parsing.
- Verify tests reject malformed metadata without memory errors or crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-29022 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H1.85.5VulnCheckCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
6.8MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2026-001-dr-libs-heap-overflow.mdCVE reference, VulnCheck · technical-description, exploit
- https://github.com/mackron/dr_libs/issues/296CVE reference, VulnCheck · issue-tracking
- https://github.com/mackron/dr_libs/commit/8a7258cc66b49387ad58cc5b81568982a3560d49CVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/mackron-dr-libs-heap-buffer-overflow-via-wav-fileCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Heap-based Buffer Overflow
Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.