Bug 2444308 - CVE-2026-29022 dr_libs: dr_libs: Heap buffer overflow via crafted WAV files [epel-all]
Summary: CVE-2026-29022 dr_libs: dr_libs: Heap buffer overflow via crafted WAV files [...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: dr_libs
Version: epel10
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Ben Beasley
QA Contact:
URL:
Whiteboard: {"flaws": ["239c750c-7ae9-4870-a8e3-d...
Depends On:
Blocks: CVE-2026-29022
TreeView+ depends on / blocked
 
Reported: 2026-03-04 05:27 UTC by Vipul Nair
Modified: 2026-03-13 00:58 UTC (History)
1 user (show)

Fixed In Version: dr_libs-0^20241216git660795b-3.el10_1 dr_libs-0^20241216git660795b-3.el9 dr_libs-0^20241216git660795b-3.el10_3 dr_libs-0^20241216git660795b-3.el10_2 dr_libs-0-0.29.20241217git660795b.el8
Clone Of:
Environment:
Last Closed: 2026-03-13 00:23:16 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Vipul Nair 2026-03-04 05:27:21 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Ben Beasley 2026-03-04 05:57:42 UTC
See https://www.cve.org/CVERecord?id=CVE-2026-29022. This is fixed in dr_wav 0.14.5. All EPELs (EPEL10, EPEL9, EPEL8) have 0.13.17, https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-704d471aec / https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-55f18fb87f.

Since there were significant incompatible changes from 0.13.17 to 0.14.x (and the other two dr_* libraries had incompatible changes at the same time), updating would require an Updates Policy exception. This is not the only potentially security-relevant issue fixed since dr_flac 0.12.x / dr_mp3 0.6.x / dr_wav 0.13.x. It is just the only one that has been assigned a CVE, as far as I know.

Backporting the fix for this CVE in particular, https://github.com/mackron/dr_libs/commit/8a7258cc66b49387ad58cc5b81568982a3560d49, does seam feasible, so I will at least do that.

Comment 2 Fedora Update System 2026-03-04 10:17:47 UTC
FEDORA-EPEL-2026-140aefd33c (dr_libs-0^20241216git660795b-3.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-140aefd33c

Comment 3 Fedora Update System 2026-03-04 10:26:20 UTC
FEDORA-EPEL-2026-04b0cd43d5 (dr_libs-0^20241216git660795b-3.el10_2) has been submitted as an update to Fedora EPEL 10.2.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-04b0cd43d5

Comment 4 Fedora Update System 2026-03-04 10:44:19 UTC
FEDORA-EPEL-2026-86f8917aae (dr_libs-0^20241216git660795b-3.el10_1) has been submitted as an update to Fedora EPEL 10.1.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-86f8917aae

Comment 5 Fedora Update System 2026-03-04 10:58:01 UTC
FEDORA-EPEL-2026-2b061badd7 (dr_libs-0^20241216git660795b-3.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-2b061badd7

Comment 6 Fedora Update System 2026-03-04 11:54:35 UTC
FEDORA-EPEL-2026-4d4c40a12a (dr_libs-0-0.29.20241217git660795b.el8) has been submitted as an update to Fedora EPEL 8.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-4d4c40a12a

Comment 7 Fedora Update System 2026-03-05 01:26:03 UTC
FEDORA-EPEL-2026-2b061badd7 has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-2b061badd7

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2026-03-05 01:57:03 UTC
FEDORA-EPEL-2026-140aefd33c has been pushed to the Fedora EPEL 10.3 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-140aefd33c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2026-03-05 02:02:22 UTC
FEDORA-EPEL-2026-86f8917aae has been pushed to the Fedora EPEL 10.1 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-86f8917aae

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2026-03-05 02:04:45 UTC
FEDORA-EPEL-2026-04b0cd43d5 has been pushed to the Fedora EPEL 10.2 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-04b0cd43d5

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Fedora Update System 2026-03-05 02:08:23 UTC
FEDORA-EPEL-2026-4d4c40a12a has been pushed to the Fedora EPEL 8 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-4d4c40a12a

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 12 Fedora Update System 2026-03-13 00:23:16 UTC
FEDORA-EPEL-2026-86f8917aae (dr_libs-0^20241216git660795b-3.el10_1) has been pushed to the Fedora EPEL 10.1 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 13 Fedora Update System 2026-03-13 00:25:07 UTC
FEDORA-EPEL-2026-2b061badd7 (dr_libs-0^20241216git660795b-3.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 14 Fedora Update System 2026-03-13 00:36:14 UTC
FEDORA-EPEL-2026-140aefd33c (dr_libs-0^20241216git660795b-3.el10_3) has been pushed to the Fedora EPEL 10.3 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 15 Fedora Update System 2026-03-13 00:49:20 UTC
FEDORA-EPEL-2026-04b0cd43d5 (dr_libs-0^20241216git660795b-3.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 16 Fedora Update System 2026-03-13 00:58:39 UTC
FEDORA-EPEL-2026-4d4c40a12a (dr_libs-0-0.29.20241217git660795b.el8) has been pushed to the Fedora EPEL 8 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.