{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"libchdr","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NRPNKKEQHJM54ZSCQMFF01","modified_at":"2026-10-01T03:03:10.372633819Z","published_at":"2026-03-17T20:16:14Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-32836","https://security-tracker.debian.org/tracker/CVE-2026-32836"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-32836","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-32836"}],"summary":"dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vulnerability in drflac__read_and_decode_metadata() that allows"}