EUVD-2026-31116
GHSA-4mj8-945c-q57m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious media file with malformed channel layout
-
DeliveryDeliver file via upload, email, or share
-
ExploitVictim or service opens file in MediaInfoLib
-
ExecutionChannel Splitting parser overflows heap buffer
-
PersistCorrupt adjacent heap structures
-
ImpactAchieve code execution or crash parsing process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process an attacker-supplied media file through MediaInfoLib's Channel Splitting parsing path - meaning an application that links MediaInfoLib must actually open the crafted file (CVSS UI:R). The attack vector is Local (AV:L), so the file must reach the host (download, email, upload to a media pipeline, mounted share) and be parsed; PR:N means no prior authentication to the target system is needed beyond getting the file processed. Limiting factors: user or automated workflow must trigger parsing of the malicious file, the deployed MediaInfoLib version must contain the vulnerable Channel Splitting code, and successful code execution (versus mere crash) typically depends on the host's heap allocator state and platform-level mitigations such as ASLR, DEP/NX, and heap hardening. |
| Impact | The CVSS 3.1 base score of 7.8 reflects High confidentiality, integrity, and availability impact, but the attack vector is Local (AV:L) and requires User Interaction (UI:R) - meaning a victim must open or process a malicious media file rather than the bug being remotely triggerable over a network. No EPSS score, KEV listing, or public POC has been provided, and the vulnerability is not flagged as actively exploited; risk is therefore moderate and primarily relevant to workflows that ingest untrusted media (media servers, asset management, automated transcoding pipelines) where 'user interaction' may be satisfied automatically by background scanners. Key data gaps: no fix version, patched release, affected version range, or CPE has been supplied in the input, and the only reference is the Talos advisory page; vendor-confirmed remediation details cannot be cited from the available data. |
| Exploit ScenarioDerived | An attacker crafts a malicious media file with a malformed channel layout that triggers the Channel Splitting heap overflow and delivers it via email attachment, web download, or a shared asset uploaded to a media management platform. When a user or automated ingestion process opens the file with MediaInfo or any application embedding MediaInfoLib, the heap is corrupted, enabling denial of service or, with a successful exploit primitive, arbitrary code execution in the context of the parsing process. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 20, 2026
Heap-based buffer overflow in MediaArea MediaInfoLib's Channel Splitting parser allows attackers to corrupt heap memory and potentially execute arbitrary code when a victim opens a maliciously crafted media file. The CVSS 7.8 vector (AV:L/UI:R) indicates local attack with required user interaction, and no public exploit identified at time of analysis. The flaw was reported by Cisco Talos and disclosed in TALOS-2026-2374.
RemediationAI
No vendor-released patch identified at time of analysis from the provided data - consult the Talos advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2374 and the MediaArea/MediaInfoLib release page to obtain and deploy the fixed library version once published, and rebuild or update any downstream applications that statically link or bundle MediaInfoLib. Until a patched build is available, restrict MediaInfoLib processing to trusted input sources, sandbox or containerize any service that parses user-supplied media (limiting filesystem and network access of the parsing process), and disable automated/background scanning of untrusted uploads; trade-offs include reduced metadata coverage for user-submitted content and added operational complexity in transcoding pipelines.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MediaInfoLib is a widely embedded open-source library from MediaArea used to extract technical and tag metadata from audio and video container files; it is shipped inside the MediaInfo GUI/CLI tools and bundled into numerous third-party media applications, transcoders, and DAM platforms. The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and resides in the library's Channel Splitting code path, which handles per-channel audio stream decomposition during container parsing. Insufficient validation of channel layout fields in a crafted input file causes a heap buffer to be written past its allocated size, corrupting adjacent heap metadata or objects.
Know when Mediainfolib gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
MediaArea MediaInfoLib Channel Splitting heap-based buffer overflow vulnerability
Executive ViewAI
A heap-based buffer overflow in MediaArea MediaInfoLib creates arbitrary code execution risk when users open maliciously crafted media files on systems running the library. The vulnerability is exploitable only through local access and user interaction-not remotely over networks-but successful exploitation grants attackers full code execution on affected systems. Organizations deploying MediaInfoLib for content analysis, media pipeline operations, or file format detection should immediately implement compensating controls pending vendor patch availability.
No vendor-released patch identified at time of analysis. Implement interim controls: (1) Process untrusted media files only in isolated environments (containers, sandboxes, or segregated systems with minimal privileges); (2) Enforce strict file type whitelisting to restrict which media formats are processed; (3) Validate all inbound media files against whitelist before parsing; (4) Maintain audit logs of all media file processing activities; (5) Disable or restrict non-critical MediaInfoLib usage until patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Mediainfolib
View allHeap-based buffer overflow in MediaArea MediaInfoLib's LXF (Leitch eXchange Format) parser allows attackers to achieve a
Heap buffer overflow in MediaArea MediaInfoLib's ID3v2 metadata parser allows local attackers to achieve arbitrary code
Heap-based buffer overflow in MediaArea MediaInfoLib's LXF (Leitch eXchange Format) element parser allows attackers to a
Exploit-DB