CVE-2026-32836 mackron / dr_libs dr_flac.h Excessive Memory Allocation in PICTURE Metadata Parsing
Attackers can cause denial of service via memory exhaustion by supplying crafted FLAC PICTURE metadata blocks to applications using the dr_libs library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32836?
CVE-2026-32836 is a medium-severity denial of service vulnerability in mackron dr_libs dr_flac.h, published on 17 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vulnerability in drflac__read_and_decode_metadata() that allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can exploit attacker-controlled mimeLength and descriptionLength fields to cause denial of service through memory exhaustion when processing FLAC streams with metadata callbacks.
Weakness: CWE-789
Which versions are affected by CVE-2026-32836?
It affects 1 product.
Products include Mackron Dr Libs.
How do I fix CVE-2026-32836?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32836 being exploited?
There is no known exploitation of CVE-2026-32836 in the wild and no public exploit code.
Other vulnerabilities in mackron dr_libs dr_flac.h
Sources
Also known as DEBIAN-CVE-2026-32836, GHSA-6mgc-4427-8p4x, UBUNTU-CVE-2026-32836.