SDL_mixer AIFF decoder stack buffer overflow

A music-playing part can be hacked by a doctored sound file.

Summary

SDL_mixer versions 3.1.2 through 3.2.4 have a stack buffer overflow in the AIFF decoder. Decoding a crafted AIFF-C file can crash the program or let attackers run code, affecting programs that use this library.

Affected when

Decoding A-law or mu-law compressed AIFF-C files

What to do

Check that you run a version newer than 3.2.4 and read the vendor's advisory for the fixed version. No source names a fixed version.

Products and platforms

Windows
macOS
Linux
Android
iOS
SDL_mixer

CVE IDs

CVE-2026-122329 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · hackmd.io (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 15:11 UTC

First seen 2026-11-09 16:40 UTC