CVE-2026-29508
📛 CVE Title
ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser
Description
ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- VulnCheck
- CVSS severity
- HIGH
- CVSS score
- 8.7 / 10
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Effective score
- 8.7 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-121 - Reserved
- 2026-03-04
- Published
- 2026-11-02 20:25 UTC
- Last updated
- 2026-11-02 20:54 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/29xxx/CVE-2026-29508.json
- Linked Threat
- CVE-2026-29508 — ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-11-02 21:17:31 UTC
- NVD last modified
- 2026-11-02 21:17:31 UTC
- NVD CVSS v3.1
- 8.8 / 10 HIGH source: disclosure@vulncheck.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.0072 (probability of exploitation in next 30 days)
- EPSS percentile
- 53.89% vs all CVEs — higher = more likely to be exploited, as of 2026-11-03
NVD / KEV / EPSS data refreshed 2026-11-03 15:40 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-115624 - Assigner
- VulnCheck
- Published
- Nov 2, 2026, 8:25:11 PM
- Updated
- Nov 2, 2026, 8:54:09 PM
- EUVD base score (CVSS 4.0)
-
8.7 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - EUVD-reported EPSS
- 0.0000
- Vendors
- ReadyMedia
- Products
-
ReadyMedia (MiniDLNA) (1.3.0 ≤1.3.3)
- Aliases
-
GHSA-3p4r-mwmm-qcvg
ENISA description: ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.
EUVD references (4)
- https://www.kr3bz.wtf/posts/minidlna-unbounded-vla-to-rce/
- https://www.asus.com/networking-iot-servers/wifi-routers/asus-gaming-routers/rt-ax86u/helpdesk_bios?model2Name=RT-AX86-Series-RT-AX86U-RT-AX86S
- https://sourceforge.net/projects/minidlna/
- https://www.vulncheck.com/advisories/readymedia-stack-buffer-overflow-via-dff-parser
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| ReadyMedia | ReadyMedia (MiniDLNA) |
1.3.0 (affected)
|
— |
Vendor references (4)
References embedded in the original CVE record by the assigning CNA.
- Researcher Blog technical-descriptionexploit
- ASUS Fixed Firmware Download patch
- Impacted Codebase product
- VulnCheck Advisory: ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser third-party-advisory
MITRE references (4) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
- Impacted Codebase product
- ASUS Fixed Firmware Download patch
- Researcher Blog technical-description, exploit
- VulnCheck Advisory: ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser third-party-advisory
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (4)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://sourceforge.net/projects/minidlna/ disclosure@vulncheck.com
- https://www.asus.com/networking-iot-servers/wifi-routers/asus-gaming-routers/rt-ax86u/helpdesk_bios?model2Name=RT-AX86-Series-RT-AX86U-RT-AX86S disclosure@vulncheck.com
- https://www.kr3bz.wtf/posts/minidlna-unbounded-vla-to-rce/ disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/readymedia-stack-buffer-overflow-via-dff-parser disclosure@vulncheck.com
Remediations (19)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:www.aikido.dev
None of these is a clean fix , which is why the decision on how to remediate depends on knowing what package versions are running in production and why. This post will cover how AI has accelerated CVE detection and discovery, the upgrade trap, what CVE remediation actually involves in 2026 , and how to solve the CVE remediation problem.
2026-11-03 11:18 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-11-03 11:18 UTC -
web:patchmypc.com
You can find the production release history below for 2026 . View the 2025 Catalog Release History.
2026-11-03 11:18 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-11-03 11:18 UTC -
web:cvedatabase.com
Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.
2026-11-03 11:18 UTC -
web:www.oracle.com
Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.
2026-11-03 11:18 UTC -
web:cvetodo.com
CVE-2026-29508 is a CVSS 8.8 Remote Code Execution vulnerability in ReadyMedia MiniDLNA. Includes technical details, affected versions, and mitigation steps.
2026-11-03 11:18 UTC -
web:www.rapid7.com
CVE-2026-29508 : ReadyMedia ReadyMedia (MiniDLNA): ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that…. View severity, references, and remediation details from Rapid7.
2026-11-03 11:18 UTC -
web:blogs.oracle.com
For more information about the Critical Security Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-11-03 11:18 UTC -
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-11-03 10:52 UTC -
web:www.veeam.com
Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1 Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line ...
2026-11-03 10:52 UTC -
web:community.spiceworks.com
Another record-breaking patch cycle…1408 CVE's , .NET 8 and 9 reach EOS next month (start planning, if you're not already) Microsoft Publisher starts vanishing and place your bets now, on how much breaks between now and next month!
2026-11-03 10:52 UTC -
web:epatch.pa.gov
Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...
2026-11-03 10:52 UTC -
web:sec.cloudapps.cisco.com
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching ...
2026-11-03 10:52 UTC -
web:securityonline.info
Oracle Critical Patch Update for October 2026 fixes 1,209 CVEs , including six CVSS 10.0 bugs such as CVE - 2026 -101809 in E-Business Suite.
2026-11-03 10:52 UTC -
web:windowsreport.com
Windows 11 October 2026 Patch Tuesady update, KB5127648, is reportedly causing serious headaches for some business networks. The latest Patch Tuesday update, which appears to have fixed previously reported the Group Policy failure, has apparently broken WPA2-Enterprise Wi-Fi and wired 802.1X authentication.
2026-11-03 10:52 UTC -
web:www.microsoft.com
Resources you patch manually: nothing is installed automatically for you. Apply the updates now, starting with internet-facing systems, and then restart or reimage. Software you installed or bundled: you update it no matter how you patch . Rebuild and redeploy containers and custom images.
2026-11-03 10:52 UTC -
web:www.oracle.com
Text Form of Oracle Critical Patch Update - October 2026 Risk Matrices This document provides the text form of the October 2026 Advisory Risk Matrices. Please note that the CVE IDs in this document correspond to the same CVE IDs in the October 2026 Advisory. This page contains the following text format Risk Matrices: Oracle Database Server ...
2026-11-03 10:52 UTC -
web:www.pa.gov
Overview PSP established the Pennsylvania Access to Criminal History, or PATCH , for agencies, companies, and others to request criminal background checks on individuals. The information provided by the requestor will be checked against the criminal history database maintained by the Pennsylvania State Police Central Repository.
2026-11-03 10:52 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-29508.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-29508",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T20:53:56.789517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:54:09.386Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ReadyMedia (MiniDLNA)",
"vendor": "ReadyMedia",
"versions": [
{
"lessThanOrEqual": "1.3.3",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ivan Racic (kr3bz)"
}
],
"datePublic": "2026-11-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:25:11.729Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "https://www.kr3bz.wtf/posts/minidlna-unbounded-vla-to-rce/"
},
{
"name": "ASUS Fixed Firmware Download",
"tags": [
"patch"
],
"url": "https://www.asus.com/networking-iot-servers/wifi-routers/asus-gaming-routers/rt-ax86u/helpdesk_bios?model2Name=RT-AX86-Series-RT-AX86U-RT-AX86S"
},
{
"name": "Impacted Codebase",
"tags": [
"product"
],
"url": "https://sourceforge.net/projects/minidlna/"
},
{
"name": "VulnCheck Advisory: ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/readymedia-stack-buffer-overflow-via-dff-parser"
}
],
"tags": [
"x_open-source"
],
"title": "ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-29508",
"datePublished": "2026-11-02T20:25:11.729Z",
"dateReserved": "2026-03-04T15:39:26.871Z",
"dateUpdated": "2026-11-02T20:54:09.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}