Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-14369: dr_flac audio decoder can be stopped by malicious file

CVE-2025-14369 · published 9 months ago

Summary

The dr_flac component used to decode FLAC audio files may miscalculate memory needs if the file’s header contains a large frame count. This can cause the program to crash, effectively a denial‑of‑service. Update dr_flac to the latest version or apply the vendor’s patch to prevent crashes from crafted audio files.

Original advisory text

CVE-2025-14369

dr_flac, an audio decoder within the dr_libs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool.

References

https://www.kb.cert.org/vuls/id/924114 URL
https://github.com/mackron/dr_libs/commit/b2197b2eb7bb609df76315bebf44db4ec2a1ae... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14369... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-14369 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Timeline

Published20 Jan 2026

Updated29 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-14369 · NVD

CVE-2025-14369 · OSV

Track software like this

Free during beta