CVE-2026-3394

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in jarikomppa soloud up to 20200207. This affects the function SoLoud::Wav::loadwav of the file src/audiosource/wav/soloud_wav.cpp of the component WAV File Parser. Performing a manipulation results in memory corruption. The attack must be initiated from a local position. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
jarikomppa	soloud	20200207

References

https://github.com/jarikomppa/soloud/Product
https://github.com/jarikomppa/soloud/issues/401Exploit, Issue Tracking, Vendor Advisory
https://github.com/oneafter/0209/blob/main/so2/reproExploit
https://vuldb.com/?ctiid.348280Permissions Required, VDB Entry
https://vuldb.com/?id.348280Third Party Advisory, VDB Entry
https://vuldb.com/?submit.761339Third Party Advisory, VDB Entry

Timeline

Published: Mar 1, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-339408.1Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in t CVE-2026-339418.2Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompil CVE-2026-339429.8Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in Acces CVE-2026-339439.8Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code i CVE-2026-339448.8Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there CVE-2026-339459.6Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For CVE-2026-339465.9MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http CVE-2026-339475.5jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv CVE-2026-339485.3jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing CVE-2026-339498.1Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthentica CVE-2026-33959.8A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markit CVE-2026-339509.4Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalatio