CVE-2026-122328— SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder
Quick assessment
Affected
libsdl-org SDL_mixer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SDL_mixer 3.1.2 至 3.2.4 版本在 的 函数中存在一个栈缓冲区溢出漏洞。当解码 A-law 或 μ-law 格式的 WAV 文件时，攻击者可构造恶意 WAV 文件，利用其双重偏移的浮点扩展操作覆盖约 1 KB 的相邻栈内存，从而导致程序崩溃，甚至可能实现代码执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-122328
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder
Source: CVE Program / CVE List V5
Vulnerability Description
SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| libsdl-org | SDL_mixer | 3.1.2 ~ 3.2.4 | - |
|
II. Public POCs for CVE-2026-122328
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-122328
请登录查看更多情报信息。
Other References for CVE-2026-122328 (8)
-
https://github.com/libsdl-org/SDL_mixer/blob/release-3.2.4/src/decoder_wav.c#L1658-1659 technical-description
-
-
https://github.com/libsdl-org/SDL_mixer/blob/release-3.2.4/src/decoder_wav.c#L750-761 technical-description
-
https://github.com/libsdl-org/SDL_mixer/issues/907 issue-tracking
-
https://hackmd.io/@haindpwn/sdl-mixer-fetchxlaw-stack-overflow third-party-advisory
IV. Related Vulnerabilities
Same weakness: CWE-121
-
CVE-2026-123151
Gdb: gdb: stack buffer overflow in parse_tsv_definition via -
CVE-2026-121995
Gdb: gdb: stack buffer overflow in parse_tracepoint_definiti -
CVE-2026-121994
Gdb: gdb: stack buffer overflow in fetch_register_using_p vi -
CVE-2026-97371
ntopng: Stack buffer overflow (write) in nDPI custom categor -
CVE-2026-122329
SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow vi