CVE Alert: CVE-2026-122329 – libsdl-org – SDL_mixer

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution.

**Risk verdict:** High risk for applications that decode untrusted audio; there is no supplied evidence of active exploitation, so urgency depends on exposure and how readily attackers can induce file opening.

**Why this matters:** A successful attack could compromise the process handling the file, with potential loss of confidentiality, integrity or availability. Realistic goals include crashing a media application or executing code under the user’s account; impact is limited to that process’s security context unless separate weaknesses enable escalation.

**Most likely attack path:** An attacker supplies a malicious audio file, which a user or application then opens or previews. The vulnerable path is local, needs no elevated privileges and has low complexity, but requires user interaction; the flaw itself does not cross a security boundary, so lateral movement would require another step.

**Who is most exposed:** Prioritise desktop games, media tools and other software embedding this audio library, especially where users handle files from downloads, messaging or community content.

Alert on crashes in applications using the library during audio import or playback.

Review file-ingestion logs for unexpected AIFF-C content from untrusted sources.

Use endpoint telemetry to investigate unusual child processes or memory-execution behaviour after audio handling.

No KEV, SSVC, PoC or EPSS indicators were supplied; prevalence and exploitation activity remain uncertain.

Mitigation and prioritisation

Apply the upstream correction and verify the deployed build includes the decoder fix.

Until updated, block or quarantine untrusted AIFF-C files and disable their decoding where feasible.

Prioritise exposed applications that automatically preview or process user-supplied media.

Test representative audio workflows before rollout; monitor crashes after deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.