CVE-2026-11316 PUBLISHED

Assigner: talos
Reserved: 04.06.2026 Published: 10.11.2026 Updated: 10.11.2026

A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	mackron
Product	dr_libs
Versions	Default: unaffected Version 0.14.5 is affected

Credits

Discovered by Ankur Tyagi of Cisco Talos

References

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2442

Problem Types

CWE-787: Out-of-bounds Write CWE