CVE-2024-41147 is a high severity (CVSS 7.7) out-of-bounds write in the FLAC decoder of the miniaudio audio library, version 0.11.21. A crafted .flac file can corrupt memory. I could not confirm a fixed version from the sources, so check the project releases and update past 0.11.21.
What's affected
Per the NVD record, miniaudio v0.11.21 is affected. The flaw is in the function ma_dr_flac__decode_samples__lpc, which decodes FLAC audio. The CWE is a heap-based buffer overflow.
The record reference is a Talos report (TALOS-2024-2063). I could not retrieve it, so I cannot state a fixed version. Check the miniaudio repository and its release notes for the first version after 0.11.21 that addresses the issue.
miniaudio is a single-file C library, so it often lives inside other projects as a copied header. That makes it easy to miss in a dependency list.
How to check if you're exposed
Search your source trees, including vendored and third-party directories, for the header and its version macros:
grep -rn "MA_VERSION_" --include=miniaudio.h .
grep -rln "ma_dr_flac" .
A match in a game engine, media tool or audio plugin means you ship the code. Check the version number in the header. Also look for packages in your lock files and SBOMs that bundle miniaudio.
An SBOM or dependency scan that reads vendored copies is the faster route for a large codebase. The free in-browser scan checks dependency manifests without installing anything.
What to do now
- Find every project that includes miniaudio, including copies pasted into your repositories.
- Update to the latest upstream release and confirm in the release notes that the FLAC decoder issue is addressed.
- Until then, avoid decoding FLAC files from untrusted sources, or run the decoder in a sandboxed process.
- Compile with memory protections such as stack protectors and address space randomisation, and test with fuzzing on audio inputs.
- Add miniaudio to your component inventory so the next advisory is easy to match.
Why it matters
The class is CWE-122, heap-based buffer overflow. A decoder reads sizes and coefficients from the file and writes samples into a buffer. If the file lies about those values and the code does not check them, it writes past the buffer's end. That can crash the program or, with effort, change what it does.
The risk depends on where the files come from. A game that plays only bundled audio is in a different position from a tool that opens user-supplied files or downloads media. The NVD vector rates the attack as network based, so assume any path that feeds outside audio to the decoder matters.
Try it yourself
Single-header libraries hide inside other projects. This demo shows a dependency inventory that surfaces them.
Click through it at your own pace, or open it full screen.
Quick check
Why is a header-only library easy to miss?
It is copied into a repository as a source file, not installed by a package manager, so lock files and package lists never mention it.
Sources
- Talos report TALOS-2024-2063 (listed in the CVE record, page could not be retrieved)
- NVD record for CVE-2024-41147
Last reviewed: 19 October 2026.
