SDL_mixer WAV decoder stack buffer overflow allows crashes or code execution

A sound library can crash or be taken over by a crafted WAV file.

Summary

A stack-based buffer overflow in the WAV decoder's FetchXLaw function lets an attacker who supplies a crafted A-law or mu-law WAV file crash the program or possibly run code. Versions 3.1.2 through 3.2.4 are affected.

Affected when

A-law or mu-law WAV file decoding

What to do

No fixed version is named in the sources. Check that you run a version newer than 3.2.4 and read the vendor's advisory.

Products and platforms

SDL_mixer

CVE IDs

CVE-2026-122328 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · hackmd.io (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 15:11 UTC

First seen 2026-11-09 16:40 UTC