CVE-2026-11315

MediumCVSS 4.3/10Last modified Nov 12, 2026

Description

A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1131508.8Race condition in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass site isolation via a crafCVE-2026-1131516.5Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process toCVE-2026-1131528.8Confused deputy in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origCVE-2026-1131538.8Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer prCVE-2026-1131548.8Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1131558.8Missing authorization in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass systCVE-2026-1131568.8UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a CVE-2026-1131576.5Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-CVE-2026-1131588.8Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker to potentially execute arbitrary code insidCVE-2026-1131596.5Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering tCVE-2026-113168.8A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A spCVE-2026-1131608.8Out of bounds write in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandb
CVE-2026-11315: Medium severity, CVSS 4.3 | Vulnix