What is the CVSS score of CVE-2026-22554?

CVE-2026-22554 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of MediaInfoLib are affected by CVE-2026-22554?

A heap-based buffer overflow in MediaArea MediaInfoLib creates arbitrary code execution risk when users open maliciously crafted media files on systems running the library.

How to fix or mitigate CVE-2026-22554?

24 hours: Identify and inventory all systems running MediaArea MediaInfoLib (all versions); catalog which applications and workflows depend on it. 7 days: Isolate MediaInfoLib operations into restricted execution environments (sandboxed containers, dedicated user accounts, or VM isolation); implement media file type whitelisting to limit parser exposure to operationally necessary formats only. 30 days: Establish daily monitoring of TALOS-2026-2374 and MediaArea security advisories for patch release; pre-stage and test MediaInfoLib updates for immediate deployment once vendor releases a fix.

MediaInfoLib CVE-2026-22554

EUVD-2026-31116 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-20 talos-cna@cisco.com

GHSA-4mj8-945c-q57m

Buffer Overflow Heap Overflow Mediainfolib

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 14:30 vuln.today

DescriptionCVE.org

MediaArea MediaInfoLib Channel Splitting heap-based buffer overflow vulnerability

AnalysisAI

Heap-based buffer overflow in MediaArea MediaInfoLib's Channel Splitting parser allows attackers to corrupt heap memory and potentially execute arbitrary code when a victim opens a maliciously crafted media file. The CVSS 7.8 vector (AV:L/UI:R) indicates local attack with required user interaction, and no public exploit identified at time of analysis. The flaw was reported by Cisco Talos and disclosed in TALOS-2026-2374.

Technical ContextAI

MediaInfoLib is a widely embedded open-source library from MediaArea used to extract technical and tag metadata from audio and video container files; it is shipped inside the MediaInfo GUI/CLI tools and bundled into numerous third-party media applications, transcoders, and DAM platforms. The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and resides in the library's Channel Splitting code path, which handles per-channel audio stream decomposition during container parsing. Insufficient validation of channel layout fields in a crafted input file causes a heap buffer to be written past its allocated size, corrupting adjacent heap metadata or objects.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data - consult the Talos advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2374 and the MediaArea/MediaInfoLib release page to obtain and deploy the fixed library version once published, and rebuild or update any downstream applications that statically link or bundle MediaInfoLib. Until a patched build is available, restrict MediaInfoLib processing to trusted input sources, sandbox or containerize any service that parses user-supplied media (limiting filesystem and network access of the parsing process), and disable automated/background scanning of untrusted uploads; trade-offs include reduced metadata coverage for user-submitted content and added operational complexity in transcoding pipelines.