tsMuxer EUVD-2026-26923

Local file access is required - the attacker cannot exploit this remotely. The attack requires that a user with login privileges (authenticated local access) manually opens or processes a crafted media file using tsMuxer. The vulnerability is triggered only when the VVC codec parser attempts to process a frame-rate-setting operation with a malicious track_id value, which implies the input file must contain a valid VVC codec stream header that reaches the vulnerable code path. Non-default conditions limiting exploitation include: (1) tsMuxer must be installed and accessible to the attacker (or the attacker must socially engineer a legitimate user to process the malicious file), (2) the vulnerable code path is only reached if VVC codec data is present in the media file, and (3) the user must have permission to read and execute the tsMuxer binary. Default configurations are NOT vulnerable - the product is not a network service and does not automatically process files.

The real-world risk is LOW despite public exploit availability. The CVSS 4.0 vector (AV:L/AC:L/PR:L) confirms local-only attack surface with low complexity but requires user-level authentication, substantially narrowing the attack scope compared to network-based vulnerabilities. The EPSS score is not provided, but the exceptionally low CVSS score (1.9) and impact profile (VA:L - availability impact only, all confidentiality and integrity impacts are None) indicate limited practical severity. Critically, the vendor note explicitly states this affects 'products that are no longer supported by the maintainer,' meaning patch development is unlikely and users have already migrated or accepted the legacy status. The existence of public POC code elevates the disclosure risk from zero-day to known-vulnerability status, but does not materially increase exploitation likelihood given local-access-only requirements and the unsupported product status. Organizations using current versions of tsMuxer are unaffected; only legacy deployments face risk. The vulnerability is best categorized as a legacy code hygiene issue rather than an active security priority.

An attacker crafts a malformed media file (likely an .m2ts or similar container) with a specially crafted VVC codec stream that includes an invalid or out-of-bounds track_id parameter. When a user with local access opens or processes this file with a vulnerable version of tsMuxer (≤2.7.0), the VvcVpsUnit::setFPS function fails to validate the track_id, triggering a denial of service (process crash or hang). The public POC file (poc5.zip from GitHub) provides a ready-to-use test case that reproduces this condition.