smpeg CVE-2026-112009

Exploitation requires a victim to open an attacker-controlled MPEG file through smpeg's SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data entry points; the malicious file must contain a system-header stream table whose bytes all set the high bit, triggering the over-read in MPEGsystem::FillBuffer() past the 16384-byte buffer. Limiting factors: no network vector (AV:L - the file must reach and be opened locally), mandatory user interaction (UI:P - the application must be invoked on the crafted file), and no authentication is required by the attacker but also no remote reachability; the impact is confined to a crash of the hosting application, so exposure is limited to systems that actually use smpeg to parse untrusted MPEG input.

This is a moderate-severity denial-of-service issue, not a high-priority emergency. The authoritative CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) tells a consistent story: local attack vector (AV:L) with passive user interaction (UI:P) means the victim must open an attacker-supplied MPEG file, and the only impact is availability (VA:H) via an application crash - confidentiality and integrity are explicitly rated N despite this being an out-of-bounds READ. That is notable: an OOB read (CWE-125) is often an information-disclosure primitive, yet the vendor/NVD vector and the description both characterize the outcome strictly as a crash, so treat this as DoS rather than data leakage unless proven otherwise. Public exploit/POC code exists (VulnCheck advisory plus a hackmd write-up), which raises practical likelihood, but there is NO CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation - the POC signal and the absence of in-the-wild exploitation are distinct and should not be conflated. SSVC-style reasoning: exploitation is POC-only, not automatable (requires a human to open a malicious file), and technical impact is partial (crash only). Net: a real but low-urgency bug whose risk is bounded by local vector, required user interaction, the crash-only impact, and the niche footprint of the affected library.

An attacker crafts a malicious MPEG file whose system-header stream table bytes all have the high bit set, then delivers it to a victim (e.g., via download or email) who opens it in an application built on smpeg via SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data. When MPEGsystem::FillBuffer() parses the header it reads past the 16384-byte heap buffer, crashing the application. Publicly available POC/exploit code demonstrates the crash, but exploitation requires the victim to actively open the file (local vector, user interaction).