EUVD-2026-31808
GHSA-fmqg-j5qj-j8f6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft malformed LXF file with overflowing length field
-
DeliveryDeliver via email, web download, or media ingest
-
ExploitVictim opens file in MediaInfo or pipeline auto-parses
-
InstallInteger underflow triggers heap buffer overflow
-
C2Hijack control flow via corrupted heap metadata
-
ExecuteExecute arbitrary code in user context
-
ImpactPivot into media asset pipeline
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Exploitation requires (1) the victim's system to use MediaInfoLib 26.01 (or any version bundling the vulnerable LXF parser), (2) the attacker to deliver a crafted LXF-format file, and (3) the victim to open or otherwise cause MediaInfoLib to parse that file - the CVSS UI:R user-interaction requirement. Local attack vector (AV:L) means the file must reach the local system, but no prior authentication, elevated privileges, or non-default MediaInfo configuration is needed; the LXF parser is part of the library's standard format dispatch. Exploitation is meaningfully limited by the UI:R requirement in interactive use, but this limiter disappears in automated ingest environments where MediaInfo is invoked on every uploaded asset. |
| Impact | The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a classic client-side file-parsing flaw: an unauthenticated attacker must convince a local user to open a malicious LXF file, after which full confidentiality, integrity, and availability impact is achievable in the user's context. This sharply contrasts with the very low EPSS score (0.01%, 2nd percentile) and CISA SSVC assessment of Exploitation=none and Automatable=no, indicating no observed exploitation and no realistic mass-exploitation path - though SSVC still flags Technical Impact as total. The flaw is not on CISA KEV, so the practical priority is moderate: high impact per successful exploitation but low likelihood of opportunistic attack, making this most relevant for environments that ingest untrusted media files (forensic labs, broadcast workflows, transcoding services) where automated parsing removes the UI:R limiter. |
| Exploit ScenarioDerived | An attacker emails or hosts a crafted .lxf file with a malformed length field; a video engineer or archivist opens it in MediaInfo (or it is auto-parsed by an asset-management ingest worker), triggering the heap overflow and yielding code execution under the user or service account. From that foothold the attacker can pivot into the media pipeline, exfiltrate pre-release content, or stage further internal compromise. No public POC is currently known beyond the Talos research advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Heap-based buffer overflow in MediaArea MediaInfoLib's LXF (Leitch eXchange Format) parser allows attackers to achieve arbitrary code execution when a victim opens a maliciously crafted LXF media file. The flaw affects MediaInfoLib 26.01 and was reported by Cisco Talos (TALOS-2026-2367); no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.01%.
RemediationAI
No vendor-released patch identified at time of analysis; monitor the MediaArea project (https://mediaarea.net) and the Talos advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2367 for a fixed version superseding 26.01, then upgrade all embedded copies of MediaInfoLib across CLI, GUI, and downstream integrations. As compensating controls until a patch is released, configure media-ingest pipelines to reject files with the LXF extension or LXF magic bytes at the gateway, which removes the attack surface entirely but blocks legitimate Leitch broadcast workflows; alternatively, run MediaInfo parsing inside a sandboxed or containerized worker with no network egress and minimal filesystem access, which contains successful exploitation at the cost of added operational complexity. End users should avoid opening LXF files from untrusted sources and disable any shell-integration previewers that auto-invoke MediaInfo on file selection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MediaInfoLib is a widely used open-source library from MediaArea that extracts technical and tag metadata from audio and video files, embedded in tools such as MediaInfo CLI/GUI, and consumed by media-processing pipelines, archival systems, and content-management platforms. The vulnerability resides in the parser for LXF (Leitch eXchange Format), a broadcast container format historically used by Harmonic/Leitch playout systems. The root-cause CWE-191 (Integer Underflow) - paired with the reported buffer overflow and integer overflow tags - indicates that a malformed length or size field in an LXF stream wraps around during arithmetic, producing an undersized heap allocation or oversized copy that overruns an adjacent heap chunk during subsequent parsing, corrupting heap metadata and adjacent objects.
Know when Mediainfolib gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (talos) · only source for this CVE.
CVSS VectorVendor: talos
DescriptionCVE.org
MediaArea MediaInfoLib LXF parsing heap-based buffer overflow vulnerability
Executive ViewAI
MediaInfoLib 26.01 contains a buffer overflow vulnerability in media file parsing that enables arbitrary code execution when a victim opens a malicious file. Organizations using MediaInfoLib in media production, broadcast, or digital asset workflows face potential compromise, though no public exploit identified at time of analysis and current exploitation probability remains very low (0.01% EPSS).
Process all files in sandboxed, network-isolated environments before MediaInfoLib handling; enforce verified file sources and origin validation; disable LXF format support if not operationally required; implement file type validation at ingestion points; maintain detailed logging and monitoring of MediaInfoLib process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
More in Mediainfolib
View allHeap buffer overflow in MediaArea MediaInfoLib's ID3v2 metadata parser allows local attackers to achieve arbitrary code
Heap-based buffer overflow in MediaArea MediaInfoLib's LXF (Leitch eXchange Format) element parser allows attackers to a
Heap-based buffer overflow in MediaArea MediaInfoLib's Channel Splitting parser allows attackers to corrupt heap memory
Exploit-DB