{"id":"CVE-2026-29508","published":"2026-11-02T21:17:31.087","lastModified":"2026-11-02T21:17:31.087","description":"ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://sourceforge.net/projects/minidlna/","tags":[]},{"url":"https://www.asus.com/networking-iot-servers/wifi-routers/asus-gaming-routers/rt-ax86u/helpdesk_bios?model2Name=RT-AX86-Series-RT-AX86U-RT-AX86S","tags":[]},{"url":"https://www.kr3bz.wtf/posts/minidlna-unbounded-vla-to-rce/","tags":[]},{"url":"https://www.vulncheck.com/advisories/readymedia-stack-buffer-overflow-via-dff-parser","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"ReadyMedia versions 1.3.0–1.3.3 contain a stack-based buffer overflow (CWE-121) triggered by parsing a malicious DFF audio file with an oversized PROP chunk size, which is used unvalidated to allocate a stack array and read data into it, enabling remote code execution or denial of service.","exploitability":"Exploitation requires placing a crafted DFF file in a directory monitored by ReadyMedia; the attacker must have network access and valid credentials (low privilege sufficient) to trigger automatic parsing via inotify.","blast_radius":"Successful exploitation allows remote code execution on the affected server, potentially compromising the host and any downstream services or data accessible to the service account.","remediation":"Upgrade to ReadyMedia version 1.3.4 or later, which contains the official fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["stack-overflow","rce","media-server","inotify"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:59:21.619Z"}}