CVE-2026-111164 in UADE
Summary
by MITRE • 10/15/2026
UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applications that probe or play it.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified as UADE through version 3.05 represents a critical memory safety flaw located within the uade_filemagic function in the amifilemagic.c source file. This specific defect is classified under CWE-126, which denotes an out-of-bounds read condition. The root cause of this issue lies in improper handling of integer arithmetic during buffer size validation. Specifically, when processing short input data, the code performs a subtraction operation on an unsigned bufsize variable that results in an underflow or wrap-around error. Because the variable is treated as unsigned, subtracting a value larger than the current count does not result in a negative number but instead wraps around to a very large positive integer. This mathematical anomaly effectively bypasses subsequent bounds checking logic, which relies on this corrupted size value to determine safe memory access limits.
From an operational perspective, this flaw allows attackers to craft malicious module files that appear valid during initial format probing stages. These crafted inputs are designed specifically to exploit the wrap-around behavior, tricking the application into believing it has sufficient buffer space for a read operation. Consequently, when the application attempts to process these malformed modules, it proceeds to read memory locations far beyond the allocated buffer boundaries. This unauthorized access violates the principle of least privilege and data integrity, leading directly to application crashes or potential denial of service conditions. The impact is particularly severe in environments where UADE is used for automated scanning or playback of audio module files, as any untrusted input can trigger this instability without requiring user interaction beyond file selection.
In terms of threat modeling, this vulnerability aligns with ATT&CK technique T1203, which covers Exploitation for Defense Evasion, although its primary manifestation here is stability disruption rather than stealthy persistence. The attack vector involves supplying a specially crafted short module that passes initial format checks but exploits the integer overflow during size calculation. This scenario highlights the risks associated with trusting input data lengths without rigorous validation of arithmetic operations on unsigned integers. Security analysts should note that such vulnerabilities often serve as precursors to more severe exploitation vectors, including information disclosure or remote code execution if adjacent memory structures contain sensitive pointers or control flow metadata.
Mitigation strategies must focus on correcting the integer handling logic within the uade_filemagic function. Developers should implement strict checks to ensure that subtraction operations on buffer sizes do not result in wrap-around values by verifying that the operand is less than or equal to the base value before performing the operation. Additionally, adopting defensive programming practices such as using signed integers for size calculations where appropriate can prevent unsigned underflow issues. Input validation routines must be enhanced to detect and reject malformed modules early in the processing pipeline, ensuring that any anomaly in expected file structure triggers an immediate error rather than proceeding with potentially unsafe memory operations. Regular static analysis scanning should also be employed to identify similar patterns of integer misuse across the codebase to prevent recurrence of this class of vulnerability.