---
id: CVE-2026-29508
title: ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser
summary: >-
  ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a
  stack-based buffer overflow vulnerability that allows remote attackers to
  corrupt stack memory by crafting a malicious DFF audio file with an oversized
  PROP chunk size…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-121
vendor: ReadyMedia
product: ReadyMedia (MiniDLNA)
affected:
  - minidlna >= 1.3.0 <= 1.3.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T20:53:56.789517Z'
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T20:54:09.386Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-29508'
references:
  - url: 'https://www.kr3bz.wtf/posts/minidlna-unbounded-vla-to-rce/'
    label: Researcher Blog
  - url: >-
      https://www.asus.com/networking-iot-servers/wifi-routers/asus-gaming-routers/rt-ax86u/helpdesk_bios?model2Name=RT-AX86-Series-RT-AX86U-RT-AX86S
    label: ASUS Fixed Firmware Download
  - url: 'https://sourceforge.net/projects/minidlna/'
    label: Impacted Codebase
  - url: >-
      https://www.vulncheck.com/advisories/readymedia-stack-buffer-overflow-via-dff-parser
    label: >-
      VulnCheck Advisory: ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF
      Parser
tags:
  - cve.org
  - exploit-available
epss: 0.00718
epssPercentile: 0.54086
ingestedAt: '2026-11-05T19:30:42.846Z'
---

## Overview

ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.

## Affected

- `minidlna >= 1.3.0 <= 1.3.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.