EUVD-2026-31255
GHSA-5x97-5xp3-2v33
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious LXF file
-
DeliveryDeliver via email or media ingest
-
ExploitVictim opens file in MediaInfo-based tool
-
ExecutionLXF element parser triggers heap overflow
-
PersistHijack control flow in process context
-
ImpactExecute arbitrary code as the user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Use after free prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or have an automated workflow process a maliciously crafted LXF (Leitch eXchange Format) file with MediaInfoLib's LXF demuxer - this is the exact feature path named in the description. The CVSS vector confirms local attack vector (AV:L) with required user interaction (UI:R), so the attacker must deliver the file and induce parsing, but no authentication or elevated privileges on the target are needed (PR:N). Limiting factors: only LXF-format input reaches the vulnerable parser, the impact is confined to the user/service account running MediaInfo (S:U), and environments that do not handle broadcast LXF media or that strip non-whitelisted container formats at ingest are not realistically exposed. |
| Impact | The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) frames this as a client-side memory-corruption issue: exploitation requires the victim to open a malicious file (UI:R) and runs in the victim's process context, not as a network-reachable service. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, so this is not currently a mass-exploitation priority, but heap overflows reported by Cisco Talos historically prove exploitable for code execution, especially in C++ parsers like MediaInfoLib. EPSS and KEV data were not supplied in the input, so probability of exploitation cannot be quantified - risk should be assessed as elevated for environments that automatically process untrusted media (ingest farms, DAM systems, forensics labs) and moderate for typical desktop users. |
| Exploit ScenarioDerived | An attacker emails or shares a malicious .lxf file (or hosts it on a site that a broadcast/media workflow auto-ingests) and a user opens it in MediaInfo or any application that hands the file to MediaInfoLib for metadata extraction. The crafted LXF element triggers the heap overflow during parsing, corrupting heap metadata to redirect execution and run attacker-supplied code in the context of the victim's process. No public PoC is referenced in the input, but Talos typically publishes triggering details after a vendor patch window. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 21, 2026
Heap-based buffer overflow in MediaArea MediaInfoLib's LXF (Leitch eXchange Format) element parser allows attackers to achieve arbitrary code execution when a victim opens a maliciously crafted LXF media file. The flaw, disclosed by Cisco Talos as TALOS-2026-2371 and assigned CWE-823, requires user interaction and local file access but no privileges, and at the time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis from the provided data; defenders should consult the Talos report at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2371 and the MediaArea downloads page to identify and deploy the fixed MediaInfoLib build once published, then rebuild or update any downstream tooling that statically links or bundles libmediainfo. As compensating controls until a patched build is rolled out, restrict the library from processing untrusted LXF input - for example, filter or block .lxf extensions at the ingest gateway, gate file uploads through a sandbox that drops or normalizes broadcast container formats, and run MediaInfo-based scanners under low-privileged service accounts with seccomp/AppArmor or a container so a successful overflow cannot pivot; the trade-off is that LXF-bearing broadcast workflows will need a manual exception path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MediaInfoLib is the open-source parsing library that powers the MediaInfo tool and is widely embedded in media management pipelines, asset workflows, transcoders, and forensic tools to extract codec, container, and stream metadata. The vulnerability lies in the LXF (Leitch eXchange Format, a broadcast container format) demuxer, where element parsing performs an out-of-range pointer offset (CWE-823) leading to a heap-based buffer overflow when sizes or offsets inside an LXF element are not validated against the underlying allocation. Because MediaInfoLib is consumed by many downstream products (desktop MediaInfo, server-side ingest tools, NLE plugins) via the same shared parsing code path, any consumer that hands attacker-controlled LXF files to the library inherits this exposure.
Know when Mediainfolib gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (talos) · only source for this CVE.
CVSS VectorVendor: talos
DescriptionCVE.org
MediaArea MediaInfoLib LXF element parsing heap-based buffer overflow vulnerability
Executive ViewAI
MediaArea MediaInfoLib vulnerability (CVE-2026-28764) enables remote code execution through malicious media files, with no patch currently available. Organizations processing, storing, or analyzing media files face elevated risk of system takeover and data breach. The attack requires only user interaction with a crafted file, making this exploitable at scale across typical business environments.
No vendor-released patch identified at time of analysis. Interim mitigations include: disable LXF format support if not operationally required; implement strict input validation rejecting LXF files from external or untrusted sources; execute MediaInfoLib in restricted sandboxed environments with minimal system privileges and file system access; enforce application whitelisting on systems handling media file processing; deploy file type detection and filtering at ingestion points; monitor system logs and file access patterns for suspicious LXF file processing activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Mediainfolib
View allHeap-based buffer overflow in MediaArea MediaInfoLib's LXF (Leitch eXchange Format) parser allows attackers to achieve a
Heap buffer overflow in MediaArea MediaInfoLib's ID3v2 metadata parser allows local attackers to achieve arbitrary code
Heap-based buffer overflow in MediaArea MediaInfoLib's Channel Splitting parser allows attackers to corrupt heap memory
Exploit-DB