CVE-2019-13626

Name of the Vulnerable Software and Affected Versions SDL (Simple DirectMedia Layer) versions 2.x through 2.0.9

Description The issue is related to a heap-based buffer over-read in Fill IMA ADPCM block, caused by an integer overflow in the IMA ADPCM decode() function in audio/SDL wave.c. This can be exploited by a remote attacker using a specially crafted file, potentially leading to a denial of service.

Recommendations For versions 2.x through 2.0.9, consider disabling the IMA ADPCM decode() function as a temporary workaround until a patch is available. Restrict access to the audio/SDL wave.c component to minimize the risk of exploitation. Avoid using the Fill IMA ADPCM block function in the affected SDL versions until the issue is resolved.