SDL_mixer versions 3.1.2 through 3.2.4 contain a stack-based buffer overflow in the FetchXLaw() function within src/decoder_aiff.c. The vulnerability arises from miscalculated output offsets when expanding A‑law or mu‑law samples in AIFF‑C files. An attacker can craft a malicious AIFF‑C file that, when decoded, overwrites roughly 1 kB of adjacent stack memory. This overflow can cause application crashes or, depending on the environment, may lead to remote code execution by corrupting control data such as return addresses. The impact therefore includes availability loss and a potential elevation of privilege or code execution within the process context of any application that loads the vulnerable SDL_mixer library.

The vulnerability affects the SDL_mixer library provided by libsdl-org, specifically all releases from 3.1.2 up to and including 3.2.4. End‑users of any software that embeds these library versions and processes AIFF‑C audio files are at risk.

The CVSS score of 8.5 indicates a high severity of the flaw. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, indicating that official exploitation may not yet be widespread. The most likely attack vector is through a malicious AIFF‑C file supplied to an application that uses SDL_mixer for audio decoding; the attacker needs only to provide the crafted file to the vulnerable application. Given the nature of the buffer overflow, exploitation is feasible in a typical local context where the application runs with elevated privileges, hence the need for immediate remediation.