EUVD-2026-31807
GHSA-5xvx-vqhq-2pqv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious ID3v2-tagged audio file
-
DeliveryDeliver via email, download, or shared storage
-
ExploitVictim or pipeline opens file with MediaInfoLib
-
ExecutionTrigger heap buffer overflow in ID3v2 parser
-
PersistHijack control flow for code execution
-
ImpactExecute payload as parsing process user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim (or an automated service) to open or scan an attacker-supplied media file containing a malformed ID3v2 metadata tag using a tool that links MediaInfoLib 26.01. Per CVSS AV:L/UI:R, the attacker does not need network access to the target but must deliver the file and induce processing - limiting factors include the user-interaction or pipeline-ingestion requirement, the need for the specific vulnerable library version to be linked, and that exploitation runs only with the privileges of the parsing process (typically a user account or an unprivileged media-processing service rather than root). |
| Impact | Signals diverge sharply: CVSS 7.8 (High) reflects the High C/I/A impact of code execution, but the vector AV:L/AC:L/PR:N/UI:R describes a local-file attack requiring a user to open a malicious media file - not a remote network exploit. EPSS at 0.01% (2nd percentile) and CISA SSVC 'Exploitation: none, Automatable: no' both indicate no observed exploitation and that mass-scale automated abuse is unlikely given the UI:R requirement. There is no CISA KEV listing and no public PoC identified. Realistic priority is moderate for environments that ingest untrusted media (forensic labs, DAM platforms, mail/file scanners, transcoding pipelines), and lower for end-user desktops that already vet inputs. Note that AV:L combined with the description's parsing-on-file-open semantics is internally consistent - the 'local' vector reflects that the attacker delivers a file rather than reaching the service over the network. |
| Exploit ScenarioDerived | An attacker crafts an MP3 (or other ID3v2-tagged audio file) with malformed tag frames that overflow the heap when parsed, then delivers it via email attachment, web download, or a shared media library. When a victim or an automated ingestion pipeline opens the file with a tool that links MediaInfoLib, the parser corrupts heap memory and the attacker achieves code execution in the context of the user or service account running the parser. No public PoC has been identified, but Talos's report typically includes enough technical detail for skilled attackers to reproduce the crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Heap buffer overflow in MediaArea MediaInfoLib's ID3v2 metadata parser allows local attackers to achieve arbitrary code execution when a victim opens a crafted media file. The flaw affects MediaInfoLib 26.01 and requires user interaction to trigger, with no public exploit identified at time of analysis. While CVSS rates it 7.8 (High), the very low EPSS score (0.01%) and SSVC 'Exploitation: none' signal suggest no widespread targeting is occurring.
RemediationAI
No vendor-released patch identified at time of analysis from the provided data - monitor the Talos advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2368 and the MediaArea project for a release succeeding 26.01 and upgrade as soon as it ships. Until a fix is available, restrict MediaInfoLib processing to trusted media sources, disable or sandbox automated ingestion pipelines that scan attacker-controlled audio files, and consider running the parser inside a hardened container or seccomp/AppArmor profile to contain heap corruption - the trade-off being added operational complexity and possible throughput loss in transcoding workflows. For desktop users, instruct staff not to open ID3v2-bearing audio files from untrusted senders; this mitigates the UI:R requirement but does not eliminate risk from previously-stored files. Track VulDB entry https://vuldb.com/vuln/365623 for additional remediation detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MediaInfoLib is a widely embedded open-source C++ library by MediaArea that extracts technical and tag metadata from audio and video container formats; it is used by the MediaInfo GUI/CLI and integrated into countless third-party media tools, transcoders, and asset-management systems. The vulnerable code path lies in the parser for ID3v2 tags - the metadata frame format embedded in MP3 and other audio files - where malformed frame headers or oversized fields cause out-of-bounds writes on the heap (CWE-122: Heap-based Buffer Overflow). Affected component per CPE is cpe:2.3:a:mediaarea:mediainfolib with version 26.01 confirmed by EUVD. Heap corruption in a parsing library of this kind is a classic vector for memory-corruption exploitation, and the 'total' technical impact in SSVC reflects that a successful overwrite can pivot to code execution within the host process.
Know when Mediainfolib gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (talos) · only source for this CVE.
CVSS VectorVendor: talos
DescriptionCVE.org
MediaArea MediaInfoLib ID3v2 parsing heap buffer overflow vulnerability
Executive ViewAI
MediaArea MediaInfoLib 26.01 contains a heap buffer overflow in its ID3v2 metadata parser that enables arbitrary code execution when local users open crafted media files; no vendor patch is currently available. This vulnerability exposes organizations running MediaInfoLib to code-execution risk, particularly in systems processing untrusted media content. While no public exploit exists and EPSS metrics indicate low current targeting, the absence of a patch means affected systems will remain vulnerable until a fix is released.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Execute MediaInfoLib processes under least-privilege service accounts; (2) Implement file-type and source validation; restrict untrusted media ingestion; (3) Disable ID3v2 metadata parsing where operationally feasible; (4) Isolate affected systems from untrusted network sources; (5) Enable application event logging for failed parsing attempts; (6) Monitor vendor advisories for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Mediainfolib
View allHeap-based buffer overflow in MediaArea MediaInfoLib's LXF (Leitch eXchange Format) parser allows attackers to achieve a
Heap-based buffer overflow in MediaArea MediaInfoLib's LXF (Leitch eXchange Format) element parser allows attackers to a
Heap-based buffer overflow in MediaArea MediaInfoLib's Channel Splitting parser allows attackers to corrupt heap memory
Exploit-DB