ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser
Affects ReadyMedia (MiniDLNA) versions 1.3.0 through 1.3.3, the versions that include the DFF parser. No fixed version is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- Fix or patch referenced
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects ReadyMedia / MiniDLNA versions 1.3.0 through 1.3.3, where the DFF parser exists A crafted DFF file must be placed in a media directory that ReadyMedia monitors, and inotify must be enabled The advisory states there are prerequisites for exploitation that it does not fully list
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 33/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
ReadyMedia (formerly MiniDLNA), a media server program, is affected by a flaw in how it parses DFF audio files. An attacker who places a specially crafted file in a folder the server monitors can corrupt memory and potentially run malicious code, or crash the server.
Read the original description
ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.
What to do
Check whether your setup matches what the bug needs.
Affects ReadyMedia / MiniDLNA versions 1.3.0 through 1.3.3, where the DFF parser exists A crafted DFF file must be placed in a media directory that ReadyMedia monitors, and inotify must be enabled The advisory states there are prerequisites for exploitation that it does not fully listApply the patch listed under Evidence.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- ReadyMedia ReadyMedia (MiniDLNA)
From 1.3.0 · through 1.3.3
Evidence 4
- Patch
- Exploit
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-29508
What does this mean?
A stack buffer overflow in the DFF file parser of ReadyMedia (MiniDLNA). The advisory says it can lead to remote command execution, shown on an ASUS RT-AX86U router, and can also crash the service.Source: kr3bz.wtf
Am I affected, and how do I check?
Versions 1.3.0 through 1.3.3 are listed, since only those versions contain the DFF parser. The setup also matters: a crafted DFF file must be placed in a media directory that ReadyMedia monitors, with inotify enabled (inotify = yes). The advisory says there are further prerequisites it does not fully list.Source: kr3bz.wtf
What should I do about it?
The checked facts do not name a fixed version, so no upgrade target is given here. Check the vendor advisory for a patched release and move to it when available.Source: kr3bz.wtf
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data