EUVD-2026-55963
GHSA-372p-8x23-5hx8
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Attacker must deliver crafted signed video content that a user actively opens in a validation tool; no privileges needed, but high complexity and mandatory user interaction apply; impact is crash-only with no confidentiality or integrity effect.
Primary rating from Vendor (Axis).
CVSS VectorVendor: Axis
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Signed Video Framework contained a buffer overflow issue
which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected.
AnalysisAI
Buffer overflow in Axis Communications' Signed Video Framework crashes applications that use its signed content validation tooling. Specifically, the Signed Media Verifier and Axis File Player are affected when processing maliciously crafted signed video content, while the AXIS OS device-side signed video functionality remains entirely unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target is running one of the three affected validation tools - Signed Video Framework library, Signed Media Verifier, or Axis File Player - and that a user actively opens or processes a specially crafted signed video file (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H reflects a remotely triggerable crash that requires both high attack complexity and user interaction, substantially constraining real-world exploitability - even a mid-sized municipal IT team in opole deploying these validation tools would find the practical attack surface limited to scenarios where an analyst manually opens a crafted signed video file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malformed signed video file with a payload designed to trigger the buffer overflow in the framework's validation logic, then delivers it to a target analyst or automated system that uses Signed Media Verifier or Axis File Player to validate signed content. When the victim opens or processes the file, the parsing routine overflows a buffer, crashing the validation application. … |
| Remediation | Consult the Axis vendor advisory at https://www.axis.com/dam/public/6c/f3/ac/cve-2026-8158pdf-en-US-543645.pdf for the authoritative fixed version - no specific patched release version was included in the available intelligence data, so a precise upgrade target cannot be confirmed here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today