Severity by source
Network delivery of a crafted file requires user interaction but no privileges; out-of-bounds write in C/C++ parser creates realistic full-impact potential.
Lifecycle Timeline
2DescriptionCVE.org
[GHSA-5gf7-wjfm-vmvm: Out-of-bounds bit clears for negative Matroska ReadOrder values]
AnalysisAI
Out-of-bounds bit clear operations in a Matroska container format parser allow processing of maliciously crafted media files containing negative ReadOrder field values to corrupt memory. The vulnerability arises when a negative integer ReadOrder value is used without adequate sign checking, causing bit-clear write operations to target memory locations outside the intended buffer boundary. Affected deployments include software in the Ubuntu ecosystem that parses Matroska (.mkv/.webm) files; no public exploit has been identified at time of analysis and CISA KEV status is not confirmed.
Technical ContextAI
Matroska is an open multimedia container format widely used for .mkv and .webm files. The ReadOrder element within a Matroska cluster governs the sequential ordering of data blocks. The vulnerability is rooted in improper handling of negative integer values for this field: when a negative ReadOrder value is parsed, it is used - without bounds or sign validation - as an index or offset into a fixed buffer, causing bit-clear (bitwise AND NOT) write operations to land before the start of the intended memory region. This class of defect is consistent with CWE-787 (Out-of-bounds Write) and potentially CWE-191 (Integer Underflow / Wrap-around), though no CWE has been officially assigned in the available data. The specific affected library is not confirmed by the supplied data but is likely a C/C++ Matroska parsing library present in the Ubuntu package ecosystem (e.g., libmatroska, libebml, GStreamer Matroska plugin, or FFmpeg). The GHSA identifier (GHSA-5gf7-wjfm-vmvm) indicates disclosure via GitHub Security Advisories.
Affected ProductsAI
The affected product is a Matroska-format media parser present in the Ubuntu package ecosystem, as indicated by the Ubuntu vendor report. The exact package name, affected version range, and CPE string are not provided in the available intelligence data. The GHSA identifier GHSA-5gf7-wjfm-vmvm should be consulted directly on GitHub Security Advisories for authoritative affected version information. Downstream Ubuntu package versions that bundle the vulnerable upstream library are also potentially affected and should be tracked via Ubuntu Security Notices (USN).
RemediationAI
Consult the GitHub Security Advisory GHSA-5gf7-wjfm-vmvm for the upstream fix commit or patched release version, then apply the corresponding vendor package update through Ubuntu's package manager (apt upgrade). No exact fix version is confirmed in the available data, so monitor Ubuntu Security Notices at ubuntu.com/security/notices for a corresponding USN advisory that will specify the patched package version. As a compensating control where patching is not immediately possible, restrict the attack surface by limiting which users or services can submit or process untrusted Matroska files - for example, disabling Matroska/WebM ingestion in media pipelines, sandboxing the parser process (e.g., via seccomp or a dedicated low-privilege user), or blocking .mkv and .webm file types at content ingestion boundaries. Sandboxing carries a compatibility trade-off if the parser is integrated into a monolithic process. No generic 'apply defense in depth' guidance is sufficient here - isolating the parsing process is the most actionable compensating control.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today