SDL_mixer 3.1.2 through 3.2.4 in the WAV decoder contains a stack-based buffer overflow in the FetchXLaw() function. A crafted A-law or mu-law WAV file can trigger a duplicated offset during float expansion, overwriting about one kilobyte of adjacent stack memory, which can lead to application crashes or potentially remote code execution. The weakness falls under CWE-121.

The issue impacts the SDL_mixer library from libsdl-org, version range 3.1.2 to 3.2.4. All installations using SDL_mixer within this range are vulnerable. The affected component is the WAV decoder source file, src/decoder_wav.c, inside those releases.

The CVSS score of 8.5 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the delivery of a malicious WAV file to any process that runs SDL_mixer. An attacker who can compel or trick the target application to load such a file can trigger the overflow, potentially leading to a crash or arbitrary code execution. Without additional mitigations, the exploitation conditions are relatively straightforward for an actor who has either local access or can influence file loading from a remote source.