CVE-2026-11316

HighCVSS 8.8/10Last modified Nov 12, 2026

Description

A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1131608.8Out of bounds write in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbCVE-2026-1131618.8Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1131628.8Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via aCVE-2026-1131638.8Buffer overflow in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary coCVE-2026-1131648.8Race condition in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions CVE-2026-1131658.8Inappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renCVE-2026-1131668.8Improper input validation in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised theCVE-2026-1131678.8Observable discrepancy in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted CVE-2026-1131688.8Incomplete cleanup in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass CVE-2026-1131699.6UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engiCVE-2026-113178.7A denial of service security issue exists in the affected product. The security issue stems from a fault occurring when a crafted CIP messagCVE-2026-1131708.8UI misrepresentation in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a
CVE-2026-11316: High severity, CVSS 8.8 | Vulnix