CVE Alert: CVE-2026-122328 – libsdl-org – SDL_mixer

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Treat this as an elevated, user-mediated risk pending confirmation of exploitation and prevalence; KEV, SSVC, PoC and EPSS indicators were not supplied, so urgency cannot be fully assessed.

A successful attack could compromise the application process, affecting the confidentiality, integrity and availability of data accessible to it. A realistic attacker goal is to deliver a malicious audio file through a game, application or content-sharing workflow to cause a crash or potentially execute code.

### Most likely attack path

An attacker must get a crafted file onto a local system and have a user open, play or otherwise import it; no elevated privileges or complex conditions are indicated. The issue is confined to the vulnerable process, with no direct scope change indicated, so lateral movement would depend on the application’s permissions and access to other resources.

### Who is most exposed

Prioritise desktop games and applications that bundle this audio library, especially those that load user-generated, downloaded or mod-provided audio.

Review crashes or abnormal exits during audio loading, including stack-protection or memory-corruption alerts.

Look for unusual audio files arriving via downloads, chat, mods or user-content directories shortly before crashes.

Correlate application execution with unexpected child processes or file and network activity.

### Mitigation and prioritisation

Identify bundled copies and move promptly to a vendor-fixed release; confirm the fix is present in packaged builds.

Until patched, block untrusted audio imports and restrict user-generated content where practical.

Test common audio workflows before staged deployment; monitor crash rates after rollout.

Obtain KEV, SSVC, PoC and EPSS data before final triage; current information does not establish whether priority 1 criteria are met.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.