Back Linuxsecurity

Fedora 44 SDL2_sound Critical Denial of Service Fix CVE-2025

Linuxsecurity •LinuxSecurity Advisories • March 14, 2026

SDL_sound is a library that handles the decoding of several popular sound file formats, such as .WAV and .OGG. It is meant to make the programmer's sound playback tasks simpler. The programmer gives SDL_sound a filename, or feeds it data directly from one of many sources, and then reads the decoded waveform data back at her leisure. If resource constraints are a concern, SDL_sound can process sound data in programmer-specified blocks. Alternately, SDL_sound can decode a whole sound file and hand back a single pointer to the whole waveform. SDL_sound can also handle sample rate, audio format, and channel conversion on-the-fly and behind-the-scenes, if the programmer desires. Update Information : Latest upstream snapshot from stable-2.0 branch. Fixes CVE-2025-14369 in bundled dr_flac.

SDL_sound is a library that handles the decoding of several popular sound

file formats, such as .WAV and .OGG. It is meant to make the programmer's

sound playback tasks simpler. The programmer gives SDL_sound a filename,

or feeds it data directly from one of many sources, and then reads the

decoded waveform data back at her leisure. If resource constraints are a

concern, SDL_sound can process sound data in programmer-specified blocks.

Alternately, SDL_sound can decode a whole sound file and hand back a

single pointer to the whole waveform. SDL_sound can also handle sample

rate, audio format, and channel conversion on-the-fly and

behind-the-scenes, if the programmer desires.

Latest upstream snapshot from stable-2.0 branch. Fixes CVE-2025-14369 in bundled dr_flac.

* Thu Mar 5 2026 Dominik Mierzejewski - 2.0.5^20260117git1be041b-1 - update to 20260117 snapshot from stable-2.0 branch - fixes CVE-2025-14369 (resolves rhbz#2431177) - fixes rpmbuild -bi --short-circuit

[ 1 ] Bug #2431177 - CVE-2025-14369 SDL2_sound: dr_flac: Denial of Service via integer overflow in FLAC metadata [fedora-43]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-9b4cb66a86' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical DoS Vulnerability in SDL_sound Libraries Across Fedora Versions A critical Denial of Service (DoS) vulnerability, identified as CVE-2025-14369, affects the SDL_sound library used in multiple Fedora versions, including 42, 43, and 44. This vulnerability arises from an integer overflow in FLAC metadata processing, potentially allowing attackers to exploit the flaw and crash applications using the library. The vulnerability has been reported in both SDL2_sound and SDL3_sound libraries, with patches released for each affected version. Users are urged to update their systems to the latest snapshots from the stable branches to mitigate the risk. The issue was first published on January 20, 2026, and has been addressed in recent updates. The vulnerability affects a wide range of applications that rely on SDL_sound for audio processing, making it a significant concern for developers and users alike. Current patches are available through the dnf update program, and users are recommended to apply these updates promptly. 5 sources 73

Extracted Entities

Attack Types (1)

DDoS

CVEs (1)

CVE-2025-14369