The vulnerability resides in the drwav__read_smpl_to_metadata_obj() function of dr_libs dr_wav.h (versions 0.14.4 and earlier). It is a heap buffer overflow that occurs when the sampleLoopCount validation in the first pass is not matched by unconditional processing in the second pass, allowing an attacker to overflow 36 bytes of attacker‑controlled data. This memory corruption can compromise the integrity of the process running drwav_init_*_with_metadata() on untrusted WAV files, potentially leading to denial of service or arbitrary code execution.

The affected product is dr_libs dr_wav.h version 0.14.4 and earlier, used by developers and applications that incorporate this open‑source library. The vendor is mackron.

The vulnerability carries a medium severity rating (CVSS 6.8) and the likelihood of exploitation is currently considered very low (EPSS < 1%). The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a specially crafted WAV file to be processed by a vulnerable application that calls drwav_init_*_with_metadata(); when triggered, the overflow can be performed without additional privileges, providing a potential local or remote attack surface depending on the deployment scenario.