How severe is CVE-2026-32837?

CVE-2026-32837 has a CVSS 3.x base score of 4.0, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-32837 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-32837?

CVE-2026-32837 affects Mackron Miniaudio. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-32837?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-32837 have an EU (EUVD) identifier?

Yes. CVE-2026-32837 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-12633.

When was CVE-2026-32837 published?

CVE-2026-32837 was published on 2026-03-17 and last updated on 2026-06-17.

CVE-2026-32837

CVE-2026-32837 is a medium-severity vulnerability in Mackron Miniaudio with a CVSS 3.x base score of 4.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-170.

Key facts

Severity: Medium (CVSS 3.x base score 4.0)
CVSS v4: 5.1
EPSS exploit prediction: 0% (14th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-12633
Weakness: CWE-170
Affected product: Mackron Miniaudio
Published: 2026-03-17
Last modified: 2026-06-17

Description

miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.

Frequently asked questions

What is CVE-2026-32837?: miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.
How severe is CVE-2026-32837?: CVE-2026-32837 has a CVSS 3.x base score of 4.0, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-32837 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-32837?: CVE-2026-32837 affects Mackron Miniaudio. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-32837?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-32837 have an EU (EUVD) identifier?: Yes. CVE-2026-32837 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-12633.
When was CVE-2026-32837 published?: CVE-2026-32837 was published on 2026-03-17 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:mackron:miniaudio:*:*:*:*:*:*:*:*

More vulnerabilities in Mackron Miniaudio

CVE-2021-34184 — Critical (CVSS 9.8): Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in ma_default_vfs_close__stdio in…
CVE-2021-34185 — High (CVSS 7.8): Miniaudio 0.10.35 has an integer-based buffer overflow caused by an out-of-bounds left shift in drwav_bytes_to_u32 in…
CVE-2024-41147 — High (CVSS 7.7): An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality of Miniaudio miniaudio…

All CVEs affecting Mackron Miniaudio →

Other CWE-170 vulnerabilities

CVE-2021-1418 — Critical (CVSS 9.9): Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms…
CVE-2021-1417 — Critical (CVSS 9.9): Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms…
CVE-2021-1411 — Critical (CVSS 9.9): Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms…
CVE-2026-5067 — Critical (CVSS 9.8): A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by…
CVE-2026-8721 — Critical (CVSS 9.8): Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in…
CVE-2021-31886 — Critical (CVSS 9.8): A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All…

Browse all CWE-170 vulnerabilities →