gnu: miniaudio: Update to 0.11.25.

* gnu/packages/cpp.scm (miniaudio): Update to 0.11.25.
[source]: Apply a patch for CVE-2026-32837.
[properties]: Mark CVE-2026-32837 as patched.
* gnu/packages/patches/miniaudio-CVE-2026-32837.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.

Signed-off-by: Andreas Enge <andreas@enge.fr>

3 files changed, 26 insertions, 2 deletions

diff --git a/gnu/local.mk b/gnu/local.mk
index e170320b745..c77989ed8ad 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1953,6 +1953,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/mia-vtk9.patch                           \
   %D%/packages/patches/mia-vtk92.patch                          \
   %D%/packages/patches/mia-vtk-version.patch                    \
+  %D%/packages/patches/miniaudio-CVE-2026-32837.patch           \
   %D%/packages/patches/minisat-friend-declaration.patch         \
   %D%/packages/patches/minisat-install.patch                    \
   %D%/packages/patches/miniz-for-pytorch.patch                  \
diff --git a/gnu/packages/cpp.scm b/gnu/packages/cpp.scm
index 6c4d2870403..3167c1ac94f 100644
--- a/gnu/packages/cpp.scm
+++ b/gnu/packages/cpp.scm
@@ -55,6 +55,7 @@
 ;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;; Copyright © 2026 bdunahu <bdunahu@operationnull.com>
 ;;; Copyright © 2026 Cayetano Santos <csantosb@inventati.org>
+;;; Copyright © 2026 Emmanouil Fragkiskos Ragkousis <manolis837@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -2635,7 +2636,7 @@ Google's C++ code base.")
 (define-public miniaudio
   (package
     (name "miniaudio")
-    (version "0.11.22")
+    (version "0.11.25")
     (source
      (origin
        (method git-fetch)
@@ -2644,7 +2645,8 @@ Google's C++ code base.")
              (commit version)))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1pjaiq71x24n9983vkhjxrsbraa24053h727db22b1rb2xyfrzm3"))))
+        (base32 "0v5pk1kfs7gyfsh4n7ypamyd26vckkyx0dm6dm7q6y7fkzlzhkfs"))
+       (patches (search-patches "miniaudio-CVE-2026-32837.patch"))))
     (build-system gnu-build-system)
     (arguments
      (list
@@ -2690,6 +2692,7 @@ Google's C++ code base.")
     (description
      "Miniaudio is an audio playback and capture library for C and C++.  It is
 made up of a single source file and has no external dependencies.")
+    (properties '((lint-hidden-cve "CVE-2026-32837")))
     (license license:expat)))
 
 ;; Deprecated on 2026-07-08.
diff --git a/gnu/packages/patches/miniaudio-CVE-2026-32837.patch b/gnu/packages/patches/miniaudio-CVE-2026-32837.patch
new file mode 100644
index 00000000000..dc8eeab913b
--- /dev/null
+++ b/gnu/packages/patches/miniaudio-CVE-2026-32837.patch
@@ -0,0 +1,20 @@
+Fix CVE-2026-32837, a heap out-of-bounds read in the WAV BEXT metadata
+parser.  Backported from upstream commit
+1df46ae9a0eed5aa9f58b179d2cc4af5d23f8bde.
+
+diff --git a/miniaudio.h b/miniaudio.h
+index b9fa5c8..38e54e8 100644
+--- a/miniaudio.h
++++ b/miniaudio.h
+@@ -80804,8 +80804,9 @@ static ma_uint64 ma_dr_wav__read_bext_to_metadata_obj(ma_dr_wav__metadata_parse
+             if (extraBytes > 0) {
+                 pMetadata->data.bext.pCodingHistory = (char*)ma_dr_wav__metadata_get_memory(pParser, extraBytes + 1, 1);
+                 MA_DR_WAV_ASSERT(pMetadata->data.bext.pCodingHistory != NULL);
+-                bytesRead += ma_dr_wav__metadata_parser_read(pParser, pMetadata->data.bext.pCodingHistory, extraBytes, NULL);
+-                pMetadata->data.bext.codingHistorySize = (ma_uint32)ma_dr_wav__strlen(pMetadata->data.bext.pCodingHistory);
++                pMetadata->data.bext.codingHistorySize = ma_dr_wav__metadata_parser_read(pParser, pMetadata->data.bext.pCodingHistory, extraBytes, NULL);
++                pMetadata->data.bext.pCodingHistory[pMetadata->data.bext.codingHistorySize] = '\0';
++                bytesRead += pMetadata->data.bext.codingHistorySize;
+             } else {
+                 pMetadata->data.bext.pCodingHistory    = NULL;
+                 pMetadata->data.bext.codingHistorySize = 0;