Back Linuxsecurity

Fedora 42 SDL2_sound Important DoS Fix 2026-bfa5bd0004 CVE-2025

Linuxsecurity •LinuxSecurity Advisories • March 14, 2026

SDL_sound is a library that handles the decoding of several popular sound file formats, such as .WAV and .OGG. It is meant to make the programmer's sound playback tasks simpler. The programmer gives SDL_sound a filename, or feeds it data directly from one of many sources, and then reads the decoded waveform data back at her leisure. If resource constraints are a concern, SDL_sound can process sound data in programmer-specified blocks. Alternately, SDL_sound can decode a whole sound file and hand back a single pointer to the whole waveform. SDL_sound can also handle sample rate, audio format, and channel conversion on-the-fly and behind-the-scenes, if the programmer desires. Update Information : Latest upstream snapshot from stable-2.0 branch. Fixes CVE-2025-14369 in bundled dr_flac.

SDL_sound is a library that handles the decoding of several popular sound

file formats, such as .WAV and .OGG. It is meant to make the programmer's

sound playback tasks simpler. The programmer gives SDL_sound a filename,

or feeds it data directly from one of many sources, and then reads the

decoded waveform data back at her leisure. If resource constraints are a

concern, SDL_sound can process sound data in programmer-specified blocks.

Alternately, SDL_sound can decode a whole sound file and hand back a

single pointer to the whole waveform. SDL_sound can also handle sample

rate, audio format, and channel conversion on-the-fly and

behind-the-scenes, if the programmer desires.

Latest upstream snapshot from stable-2.0 branch. Fixes CVE-2025-14369 in bundled dr_flac.

* Thu Mar 5 2026 Dominik Mierzejewski - 2.0.5^20260117git1be041b-1 - update to 20260117 snapshot from stable-2.0 branch - fixes CVE-2025-14369 (resolves rhbz#2431177) - fixes rpmbuild -bi --short-circuit * Fri Jan 16 2026 Fedora Release Engineering - 2.0.4-7 - Rebuilt for * Fri Jan 16 2026 Fedora Release Engineering - 2.0.4-6 - Rebuilt for * Thu Jul 31 2025 Benjamin A. Beasley - 2.0.4-5 - Go back to bundling dr_flac and dr_mp3, since it is not straightforward to patch for the current releases * Wed Jul 23 2025 Fedora Release Engineering - 2.0.4-4 - Rebuilt for * Mon Mar 24 2025 Tim Landscheidt - 2.0.4-3 - Fix documentation for devel subpackage

[ 1 ] Bug #2431177 - CVE-2025-14369 SDL2_sound: dr_flac: Denial of Service via integer overflow in FLAC metadata [fedora-43]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-bfa5bd0004' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical DoS Vulnerability in SDL_sound Libraries Across Fedora Versions A critical Denial of Service (DoS) vulnerability, identified as CVE-2025-14369, affects the SDL_sound library used in multiple Fedora versions, including 42, 43, and 44. This vulnerability arises from an integer overflow in FLAC metadata processing, potentially allowing attackers to exploit the flaw and crash applications using the library. The vulnerability has been reported in both SDL2_sound and SDL3_sound libraries, with patches released for each affected version. Users are urged to update their systems to the latest snapshots from the stable branches to mitigate the risk. The issue was first published on January 20, 2026, and has been addressed in recent updates. The vulnerability affects a wide range of applications that rely on SDL_sound for audio processing, making it a significant concern for developers and users alike. Current patches are available through the dnf update program, and users are recommended to apply these updates promptly. 5 sources 73

Extracted Entities

Fedora 42 SDL2_sound Important DoS Fix 2026-bfa5bd0004 CVE-2025

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)