CVE-2026-71261 describes an integer overflow vulnerability in the dr_libs dr_wav.h library affecting all versions through the current master branch. The flaw exists in W64 CUE chunk metadata parsing within drwav__metadata_process_chunk(), where a 64-bit chunk size is truncated to size_t on 32-bit builds, causing incorrect pre-allocated metadata capacity calculations. The subsequent read in drwav__read_cue_to_metadata_obj() uses an attacker-controlled cuePointCount field without validating it against the stage-1 capacity estimate. The only bounds check present is a DRWAV_ASSERT macro that compiles to a no-op in release builds compiled with -DNDEBUG. This combination allows a crafted W64 WAV file to trigger a heap buffer overflow in any 32-bit application that parses untrusted WAV metadata using this library. The vulnerability poses a significant risk given the wide embedding of dr_libs in audio-processing software.