The vulnerability occurs when the library parses the 64‑bit W64 CUE chunk metadata declared in WAV files. During the initial capacity calculation, the 64‑bit sizeInBytes value is truncated to a 32‑bit size_t before being divided by the fixed cue‑point byte size. On 32‑bit builds this truncation causes the estimated capacity for the extra metadata to be smaller than the actual amount needed. When the buffer is later allocated and the library writes the cue points without re‑checking the size, a heap buffer overflow can occur. The overflow can potentially allow an attacker to execute arbitrary code in the context of the application that uses the library. The flaw is limited to 32‑bit builds and requires the application to parse an externally provided WAV file.

Vendor Mackron’s dr_libs library, specifically the dr_wav.h component. All current versions up through the master branch are affected on 32‑bit architectures. Applications that link to this library and accept external WAV files are at risk.

The CVSS score of 7.8 indicates a high severity. With an EPSS of < 1%, the exploitation probability is low, but the vulnerability has not been listed in CISA KEV. Attackers could deliver a malicious WAV file to any 32‑bit application using the library, exploiting the overflow during normal metadata parsing. The exploit requires local or remote access to a file that the application processes, so it is likely to target user‑downloaded or network‑received audio files.