ANT-2026-DYWJSTZZ · faad2

heap-buffer-overflow high

Severity Claude high · Security research firm high · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-DYWJSTZZ: Heap buffer overflow in SBR QMF synthesis due to stale buffer allocation after channel pair reconstruction

A heap buffer overflow occurs in the SBR QMF synthesis stage because a previously allocated buffer is reused with stale sizing after channel pair reconstruction.

Target

Project: faad2
Discovery: static analysis — not yet dynamically reproduced

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. A trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-DYWJSTZZ.

Reference: ANT-2026-DYWJSTZZ
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits. The writeup below is the document the firm sent to the maintainer.

Verdict: true positive
Severity: high

This PR fixes a security bug in the SBR QMF synthesis path where a channel-pair element could keep a stale, undersized time_out buffer after reallocation. In that state, SBR synthesis can write past the end of the heap buffer.

The fix makes allocate_channel_pair() always free and reallocate time_out and fb_intermed based on the current upsampling state to prevent the OOB write.

TIMELINE

Dates from discovery through public reveal.

2026-03-25 Sent to maintainer
2026-03-25 Patch released
2026-03-29 Reported to tracker
2026-08-13 Maintainer acknowledged
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

afe700e84132d4d6a61440c20d21d9b65089a3a2b64c1d1f37ef2d0599e01e6fb4073909421fa3582dbd4d86a957327f3d2d2e3fd23f653b11697a542c4874c7

Committed 2026-08-13 00:01 PT

Revealed 2026-08-17 13:02 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-DYWJSTZZ",
  "bug_class": "Heap Buffer Overflow",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-29T20:42:45+00:00",
  "description": "A heap buffer overflow occurs in the SBR QMF synthesis stage because a previously allocated buffer is reused with stale sizing after channel pair reconstruction.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "faad2",
  "reproduction": null,
  "technical_details": null,
  "title": "Heap buffer overflow in SBR QMF synthesis due to stale buffer allocation after channel pair reconstruction",
  "vendor_severity": "high"
}