UADE through version 3.05 contains an out‑of‑bounds read triggered by unsigned bufsize subtraction wrapping when processing short modules. A crafted module can bypass format‑probe checks and cause the program to read past the allocated buffer, leading to application crashes when inspected or played.

UADE music player on all releases up to and including 3.05 is affected. No specific later versions are known to be vulnerable, so versions 3.06 and above likely contain the fix.

The CVSS score of 6.8 marks this as a medium severity vulnerability. The EPSS score of less than 1 % indicates a very low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Attackers would need to supply a malicious short module to the UADE application, typically through local or remote file ingestion. The vulnerability does not provide privilege escalation or data exfiltration; its primary risk is to cause a crash of the application or the process that loads the module.