The vulnerability resides in the BEXT metadata parser of miniaudio versions up to 0.11.25. Improper null-termination handling in the coding history field allows an attacker to create a crafted WAV file that triggers a heap out-of-bounds read. Key impact is memory access violation that can lead to application crashes or denial of service. No evidence of remote code execution or data exposure is provided. The weakness is categorized as CWE‑170 (Improper Null Termination).

Affected product: mackron:miniaudio version 0.11.25 and earlier. The CPE string indicates all builds of the library may be impacted. No other vendor or product versions are listed.

The CVSS score of 5.1 indicates moderate severity. EPSS below 1% suggests low probability of active exploitation at present. The vulnerability is not listed in CISA KEV, implying it is not a known actively exploited vulnerability. The likely attack vector involves user-controlled WAV files processed by applications using the vulnerable miniaudio library; an attacker would need the ability to supply or force processing of a malicious file. The risk, while moderate, can cause service interruptions and should be mitigated promptly. The mitigation is straightforward: upgrade to a fixed version. If an upgrade is not immediately possible, monitor for crashes related to WAV playback and consider input validation patches.