CVE-2026-29022: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-29022 is a heap-based buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h in the dr_libs library (by mackron). It affects dr_libs version 0.14.4 and earlier, and was discovered by Ana Kapulica of Marlink Cyber, privately reported on 2026-02-27, and publicly disclosed on 2026-02-28. The fix was merged into the master branch on 2026-02-28 (commit 8a7258c), with the patched version designated as v0.14.5. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Issue, Marlink Advisory).

The root cause is a logic mismatch between the two-pass metadata parser in drwav__metadata_process_chunk() (CWE-122: Heap-based Buffer Overflow; CWE-787: Out-of-bounds Write). In pass 1 (count stage, ~line 2737), smpl chunks are only counted toward the allocation when the sampleLoopCount field matches the size-derived loop count (sizeInBytes - DRWAV_SMPL_BYTES) / DRWAV_SMPL_LOOP_BYTES; mismatching chunks are silently skipped, so no allocation slot is reserved for them. In pass 2 (read stage, ~line 2751), the same chunk is processed unconditionally for any sizeInBytes >= DRWAV_SMPL_BYTES, causing drwav__read_smpl_to_metadata_obj() to write 9 struct fields (36 bytes of attacker-controlled data) into &pParser->pMetadata[metadataCursor], which points past the end of the heap allocation. Exploitation requires a crafted 96-byte malformed WAV file with a smpl chunk whose sampleLoopCount field (e.g., 1) does not match the size-derived count (0), triggerable via any drwav_init_*_with_metadata() call on untrusted input (GitHub Issue, Marlink Advisory, Fix Commit).

Successful exploitation results in heap memory corruption, which can lead to application crashes (denial of service), potential information disclosure through adjacent heap memory reads, and in more advanced scenarios, arbitrary code execution if an attacker can control heap layout. Any application that uses drwav_init_*_with_metadata() to process untrusted WAV files is affected, including downstream software such as EasyRPG Player and MuseScore that bundle dr_libs. User interaction is required, as the victim application must open a crafted WAV file (Marlink Advisory, Feedly).

1. Craft a malicious WAV file: Create a minimal RIFF/WAVE container (~96 bytes) containing a valid fmt chunk, an empty data chunk, an unknown chunk to consume the single metadata allocation slot, and a smpl chunk whose sampleLoopCount field is set to 1 while the size-derived loop count is 0 — creating the critical mismatch.
2. Deliver the file to the target: Social-engineer a user or automated pipeline into opening the crafted WAV file with an application that uses drwav_init_*_with_metadata() (e.g., EasyRPG Player, MuseScore, or any custom application embedding dr_libs ≤ v0.14.4).
3. Trigger the two-pass parser: When the application calls drwav_init_file_with_metadata() (or equivalent), the parser's pass 1 skips the malformed smpl chunk (no allocation slot reserved), while pass 2 processes it unconditionally.
4. Overflow the heap: drwav__read_smpl_to_metadata_obj() writes 9 struct fields (36 bytes) past the end of the allocated metadata array, corrupting adjacent heap memory.
5. Achieve impact: Depending on heap layout and application context, the result ranges from an immediate crash (DoS) to potential code execution if heap metadata or function pointers are overwritten (GitHub Issue, Marlink Advisory).

• File System: Presence of small (~96-byte), malformed WAV files with a smpl chunk whose sampleLoopCount does not match the size-derived loop count; suspicious WAV files delivered via email, download, or shared storage.
• Process: Unexpected crashes or core dumps in applications using dr_libs (e.g., EasyRPG Player, MuseScore, custom audio tools) when opening WAV files; AddressSanitizer reports referencing drwav__read_smpl_to_metadata_obj at dr_wav.h:2193.
• Logs: Application crash logs or OS crash reports showing faults originating from drwav__metadata_process_chunk, drwav_init__internal, or drwav_init_file_with_metadata; heap corruption error messages from memory-safe builds (GitHub Issue).

Update dr_libs to a version containing commit 8a7258c (v0.14.5 or later), which adds a loopCount pre-check in the read stage of drwav__read_smpl_to_metadata_obj() consistent with the count stage, preventing out-of-bounds writes on malformed smpl chunks (Fix Commit). If immediate patching is not possible, restrict WAV file processing to trusted sources only, and consider disabling metadata reading functionality if not required by the application. Downstream projects (e.g., EasyRPG Player, MuseScore) that bundle dr_libs should update their vendored copy and release patched versions; Fedora packages for these projects have already received updates (Feedly).

The vulnerability was responsibly disclosed by Ana Kapulica of Marlink Cyber, who privately notified the maintainer on 2026-02-27 before public disclosure. The maintainer (mackron) responded promptly, merging the fix on 2026-02-28 and releasing it as part of v0.14.5. Downstream Linux distributions including Fedora issued security advisories for affected packages (EasyRPG Player, MuseScore) that bundle dr_libs. Tenable/Nessus published multiple detection plugins for this CVE (Feedly, Marlink Advisory).