A heap buffer overflow vulnerability in the dr_libs dr_wav.h component exposes applications to memory corruption when parsing malicious WAV files.

The flaw exists in the drwav__read_smpl_to_metadata_obj function, where a mismatch between metadata validation logic in two separate parsing passes allows an unauthenticated attacker to trigger an out-of-bounds heap write.

Successful exploitation of this vulnerability allows an attacker to corrupt heap memory by injecting 36 bytes of controlled data. This can lead to a denial of service through application instability or potentially more severe outcomes depending on the memory layout of the host application. Given the CVSS score of 7.3, this represents a significant risk to the availability and integrity of services that rely on this library for media processing.

Immediate Action: Update the dr_libs library to the latest version, specifically incorporating the fix provided in commit 8a7258cc66b49387ad58cc5b81568982a3560d49.

Proactive Monitoring: Monitor application logs for unexpected crashes or segmentation faults, particularly when processing media files provided by external or untrusted users.

Compensating Controls: If immediate patching is not feasible, restrict the application to only process WAV files from trusted sources and implement robust input validation to filter out malformed RIFF/WAVE containers.

Public Exploit Available: Yes, a proof-of-concept is available via the researcher's published technical write-up at the Marlink Cyber advisory repository.

The vulnerability poses a clear risk to systems utilizing dr_libs for audio processing. Organizations should prioritize updating to the patched version of the library to eliminate the memory corruption vector. Until the update is applied, ensure that any ingestion of untrusted media files is performed within a sandboxed environment to limit the impact of potential memory corruption.