{"basis":"claimed","id":"CVE-2026-29508","name":"ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser","vendorProject":"ReadyMedia","product":"ReadyMedia (MiniDLNA)","publishedAt":"2026-11-02","cvss":{"score":8.7,"severity":"HIGH","version":"4.0"},"exploited":null,"epss":null,"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser","description":"ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.","cwes":["CWE-121"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:33:37.963Z","cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total"},"measured":[],"social":{"total":3,"first_seen":"2026-11-02T21:31:22.484Z","daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":3}],"top_posts":[{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/cve.skyfleet.blue/post/djgavmeb4ste4","author":"cve.skyfleet.blue","author_name":"CVE Alerts ","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:myutg2pwkjbukv7pq2hp5mtl/bafkreidzrx72dabuipp2ej2gldupqzv5nbtbez7tv4n26ekzjsot6ocdam","text":"CVE-2026-29508 - ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser\nCVE ID : CVE-2026-29508\n \n Published : Nov. 2, 2026, 8:25 p.m. | 39 minutes ago\n \n Description : ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vul...","engagement":0,"posted_at":"2026-11-02T21:50:20.197Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/thehackerwire.bsky.social/post/3mzebjselwv2d","author":"thehackerwire.bsky.social","author_name":"TheHackerWire","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:yhhqv2c64q5xv7mdwy6dbwqq/bafkreibnofwla3zl6epzaubi52gnzfchkqufk3k3eaktsy4ibsm7dtemeu","text":"🟠 CVE-2026-29508 - High (8.8)\n\nReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-29508/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack","engagement":0,"posted_at":"2026-11-02T21:31:46.000Z"},{"source":"mastodon","kind":"post","url":"https://mastodon.social/@thehackerwire/117548979485534241","author":"thehackerwire","author_name":"TheHackerWire","avatar_url":"https://files.mastodon.social/accounts/avatars/115/755/483/699/003/887/original/be4cc997d460de98.jpg","text":"🟠 CVE-2026-29508 - High (8.8) ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value tha.…","engagement":0,"posted_at":"2026-11-02T21:31:22.484Z"}],"exploit_repositories":[]}}