CVE-2026-32837: 
NixOS vulnerability analysis and mitigation

CVE-2026-32837 is a heap out-of-bounds read vulnerability in the WAV BEXT (Broadcast Extension) metadata parser of miniaudio, a single-header audio library. It affects miniaudio version 0.11.25 and all earlier releases. The vulnerability was discovered on 2026-03-09 via static analysis and fuzzing, publicly disclosed on 2026-03-17, and patched in commit 1df46ae (GitHub Issue, Red Hat Bugzilla). It carries a CVSS v3.1 base score of 4.0 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (Red Hat Advisory).

The root cause is improper null termination (CWE-170) in the ma_dr_wav__read_bext_to_metadata_obj function (miniaudio.h lines 80803–80808). When parsing a WAV file's bext chunk, the code allocates extraBytes + 1 bytes from an uninitialized malloc()-backed pool for the coding history field, reads extraBytes bytes from the file, but never writes a null terminator at pCodingHistory[extraBytes]. It then calls the unbounded ma_dr_wav__strlen() on this buffer, which scans forward byte-by-byte with no bounds check until it finds a null byte — potentially reading past the entire allocated pool (GitHub Issue). The vulnerability is triggered locally by supplying a crafted WAV file with a non-null-terminated coding history field; no authentication or user interaction is required beyond file processing. A public proof-of-concept including a concrete hex-dump of the triggering WAV file (poc_bext_no_null.bin) and ASAN-confirmed crash output is available (GitHub Issue).

Successful exploitation causes an application that uses miniaudio to process WAV files to perform an out-of-bounds heap read and crash, resulting in a denial of service. There is no confidentiality or integrity impact identified — the vulnerability is limited to availability (application crash/abnormal termination). Any application embedding miniaudio v0.11.25 or earlier that accepts WAV file input from untrusted sources is at risk (Red Hat Bugzilla, GitHub Issue).

A public proof-of-concept exploit is available on GitHub, consisting of a reproducible crafted WAV file and reproduction instructions using libFuzzer and AddressSanitizer (GitHub Issue). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only the ability to supply a malformed WAV file to an application using the vulnerable library.

1. Identify target: Locate an application that embeds miniaudio v0.11.25 or earlier and processes WAV files from user-supplied or external input.
2. Craft malicious WAV file: Construct a WAV file with a valid RIFF/WAVE header, a fmt chunk, an empty data chunk, and a bext chunk whose coding history field (bytes beyond the 602-byte fixed BEXT header) contains non-null-terminated data — for example, the 15-byte string PWM;size:44100; with no trailing \0.
3. Trigger parsing: Supply the crafted WAV file to the target application (e.g., via file upload, audio import, or command-line argument). When miniaudio's ma_dr_wav_init or equivalent function processes the file, it will invoke ma_dr_wav__read_bext_to_metadata_obj.
4. OOB read occurs: The parser allocates extraBytes + 1 bytes via uninitialized malloc(), reads extraBytes bytes without writing a null terminator, then calls ma_dr_wav__strlen() which reads past the allocation boundary.
5. Crash/DoS achieved: The unbounded read triggers a heap-buffer-overflow (OOB read), causing the application to crash or abort, confirmed by ASAN output at miniaudio.h:80659 in ma_dr_wav__strlen (GitHub Issue).

• File System: Presence of crafted WAV files with oversized or non-null-terminated bext chunk coding history fields; files where the bext chunk size exceeds 602 bytes but the extra bytes lack a null terminator.
• Process: Application crashes or abnormal terminations in processes that handle WAV file parsing; core dumps or crash reports referencing ma_dr_wav__strlen, ma_dr_wav__read_bext_to_metadata_obj, or miniaudio.h in the stack trace.
• Logs: ASAN/sanitizer output reporting heap-buffer-overflow at miniaudio.h:80659; application error logs showing unexpected exits during WAV file loading operations (GitHub Issue).

Update miniaudio to a version incorporating commit 1df46ae (which updates the bundled dr_libs to include the fix from dr_libs commit 04e40d6). The fix writes an explicit null terminator after reading the coding history field (pCodingHistory[bytesRead] = '\0') and uses the actual byte count returned by the read function instead of calling the unbounded ma_dr_wav__strlen() (miniaudio Patch, dr_libs Patch). As a workaround where patching is not immediately possible, validate WAV file structure before passing to miniaudio, sandbox audio processing operations, and restrict untrusted WAV file input (Red Hat Advisory).

Red Hat tracked the issue via Bugzilla (Bug 2448445) and published a security advisory, classifying it as medium severity (Red Hat Bugzilla, Red Hat Advisory). The vulnerability was discovered and responsibly disclosed by researcher 0xA13 via the miniaudio public GitHub issue tracker, consistent with the project's stated preference for transparent handling. Tenable added detection via Nessus plugin 302822 shortly after disclosure. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator listings.