| Name | CVE-2025-14369 |
| Description | dr_flac, an audio decoder within the dr_libs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1126694 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| libchdr (PTS) | trixie | 0.0~git20240929.aaca599+dfsg-1 | vulnerable |
| forky, sid | 0.0~git20250608.8bba774+dfsg-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| libchdr | source | (unstable) | 0.0~git20250608.8bba774+dfsg-2 | | | 1126694 |
Notes
[trixie] - libchdr <no-dsa> (Minor issue)
qtads, dosbox-x and love bundle a copy, but these are standalone end user apps, so no security impact
https://github.com/mackron/dr_libs/commit/b2197b2eb7bb609df76315bebf44db4ec2a1aed0
https://www.kb.cert.org/vuls/id/924114