Advisory · CVE-2026-29508
ReadyMedia stack overflow via crafted DFF audio file
ReadyMedia 1.3.0 through 1.3.3 lets remote attackers corrupt stack memory with a crafted DFF audio file carrying an oversized PROP chunk, reaching code execution on unprotected builds.
- Vendor
- ReadyMedia
- Product
- ReadyMedia
- Identifier / CWE
- CVE-2026-29508
CWE-121 - Action timing
- Immediate
Explain it like I’m five
ReadyMedia reads the label on a music file to decide how much shelf space to set aside, and it trusts the label completely. A file that claims a huge label makes it set aside space it does not have, spilling over into neighboring memory.
- 01Crafted DFF placed
An attacker places a crafted DFF audio file in a directory ReadyMedia monitors, for example via a shared folder on a router or NAS.
- 02Automatic parsing
ReadyMedia inotify monitoring triggers parsing of the new file without further user action.
- 03Oversized PROP chunk
The DFF parser reads an oversized PROP chunk size value and uses it unvalidated to allocate a variable-length stack array.
- 04Stack corruption
File data is read into the undersized stack array, corrupting stack memory and crashing the service, or executing code on unprotected builds.
What happened
ReadyMedia, formerly MiniDLNA, versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability in the DFF audio parser. Attackers can craft a malicious DFF file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. The record rates it high at CVSS 8.8, and notes remote code execution on unprotected builds or denial of service on hardened builds with stack protections.
No fixed upstream ReadyMedia release is stated in the NVD record or the sources checked for this run, so this advisory claims none. The researcher write-up notes the flaw was demonstrated on an ASUS router running MiniDLNA, with firmware builds later adding a bounds check for the Property chunk size, so router and NAS vendors are the patch route for embedded deployments. ReadyMedia is often exposed only on internal networks, but shared folders and cloud-sync features can deliver the crafted file from outside that trust boundary.
What to do
- Inventory ReadyMedia and MiniDLNA deployments, including routers, NAS devices, and servers, and record each version.
- Do not let untrusted files reach monitored media directories; restrict write access to shared folders to trusted users.
- Check router and NAS vendors for firmware updates carrying a fix, and apply them when available.
- Review media server logs and crash reports for unexpected restarts or DFF files from untrusted sources.
- If exploitation cannot be excluded, treat the device as compromised, rebuild or reset it, and rotate credentials reachable from it.
Management note
A media server that auto-parses anything dropped into a shared folder is a file-parsing service with a network front door. Treat monitored directories as untrusted input, and do not assume an internal-only service is safe when its folders are shared.