EUVD-2026-103463
GHSA-xc26-7mh2-w5rr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed MPEG with undersized packet length
-
DeliveryDeliver file to victim using smpeg app
-
ExploitVictim opens file via SMPEG_new* API
-
ExecutionInteger underflow wraps packet_size in stream_header()
-
PersistTrigger reachable assertion or out-of-bounds copy
-
ImpactApplication crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Exploitation requires a victim application built on smpeg (through version 2.0.0) to open an attacker-supplied, crafted MPEG file through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data; the malicious file must declare an undersized packet length in the MPEG system header so that stream_header() in MPEGsystem.cpp underflows and wraps packet_size. Limiting factors: the attack is local (AV:L) and requires user/application interaction to open or process the hostile file (UI:P) - there is no remote, unauthenticated network trigger. No special non-default configuration is needed beyond the application actually parsing untrusted MPEG input, and the realistic outcome is limited to a crash/denial of service, not code execution or data compromise per the provided data. |
| Impact | This is a moderate-risk, availability-only defect rather than a high-priority emergency. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 and is internally consistent with the description: exploitation is local, requires passive user interaction (a victim opening a crafted file), and yields only an availability impact (crash/DoS) with no confidentiality or integrity impact. Publicly available exploit code exists (reported by VulnCheck, with a HackMD writeup referenced), which raises practical likelihood, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - the signal is 'POC exists,' not 'exploited in the wild.' One cross-source nuance to verify: the HackMD reference and CWE context describe an out-of-bounds READ, which can imply a potential confidentiality/info-leak angle, yet the official description and the CVSS vector characterize the outcome strictly as a crash (VA:H, VC:N) via reachable assertion or OOB copy; treat info-disclosure as unconfirmed and DoS as the confirmed impact. Overall this is a genuine but low-urgency bug: a DoS in a largely legacy media library, meaningful for software that embeds smpeg and parses untrusted MPEG input, but not a mass-exploitation threat. |
| Exploit ScenarioDerived | An attacker crafts a malformed MPEG file whose system-header packet declares an undersized length, then delivers it to a victim application that embeds smpeg (e.g., an SDL-based game or media tool). When the victim opens the file via SMPEG_new/SMPEG_new_rwops/SMPEG_new_data, the integer underflow in stream_header() wraps packet_size and triggers a reachable assertion or out-of-bounds copy, crashing the process. Public exploit/PoC material is available (VulnCheck advisory and a HackMD technical writeup), lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
An MPEG system header that declares an undersized packet length causes an integer underflow in stream_header() in MPEGsystem.cpp, wrapping packet_size and letting a crafted file crash any application built on smpeg through version 2.0.0. The attack is local (AV:L) and requires a victim to open the hostile MPEG file through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data, so exploitation is limited to denial of service via reachable assertion or out-of-bounds copy; there is no path to code execution or data exposure in the assessed impact. Publicly available exploit code exists, but the issue is not in CISA KEV and no active exploitation is confirmed - it is a moderate, availability-only defect rather than a high-priority emergency.
RemediationAI
No vendor-released patch identified at time of analysis - no fixed smpeg release version is referenced in the available data (smpeg 2.0.0, the latest listed version, remains affected), so monitor https://github.com/icculus/smpeg and the VulnCheck advisory for an upstream commit or tagged release and backport the stream_header() fix once published. Because public exploit code exists, prioritize compensating controls: do not open untrusted or untrusted-origin MPEG files with smpeg-based applications, and where that is unavoidable, transcode or re-mux media with a hardened parser (for example ffmpeg) before handing it to smpeg consumers, accepting the added processing step and format-fidelity loss. Run smpeg-decoding processes under a low-privilege account with a supervisor or watchdog that restarts on crash so the reachable assertion becomes a contained restart rather than an outage, and cap memory/CPU with rlimits and cgroups to limit the impact of the oversized copy - the trade-off is reduced decode throughput and the need to tune limits per workload. If you maintain the library in-tree, add a validation that rejects system-header packets whose declared length is below the minimum required before any size subtraction, patch stream_header() locally to clamp packet_size, and build with assertions enabled in test environments so malformed inputs fail fast; note that locally patched builds must be re-validated against the reference write-up to confirm the underflow is actually closed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
smpeg is an open-source MPEG-1 audio/video decoding library (the icculus.org fork of Loki's SMPEG), commonly linked into SDL-based games, media players and tooling that call the SMPEG_new family of entry points. MPEGsystem.cpp implements the system-stream demuxer that walks MPEG pack headers and the system header table, reading declared packet lengths before sizing buffers and copying payload data. CWE-191 (integer underflow) is the root cause: the parser subtracts a declared packet length from an internal remaining/total length without validating that the declared value is at least the required minimum, so an undersized length wraps an unsigned size computation and produces a hugely oversized packet_size. The wrapped value is then used downstream, tripping an assertion in debug builds and driving an out-of-bounds read/copy in release builds. Because the flaw lives in the file-format parser rather than in a network service, the trust boundary is the open() of an untrusted media file, which is why the assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) rather than a remotely reachable condition.
Know when Smpeg gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local file parsing with no privileges but mandatory user action to open the crafted file (AV:L, PR:N, UI:R); impact is a crash only, so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEG_new, SMPEG_new_rwops or SMPEG_new_data to trigger a reachable assertion or out-of-bounds copy, crashing the application.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB