Smpeg
Monthly
An MPEG system header that declares an undersized packet length causes an integer underflow in stream_header() in MPEGsystem.cpp, wrapping packet_size and letting a crafted file crash any application built on smpeg through version 2.0.0. The attack is local (AV:L) and requires a victim to open the hostile MPEG file through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data, so exploitation is limited to denial of service via reachable assertion or out-of-bounds copy; there is no path to code execution or data exposure in the assessed impact. Publicly available exploit code exists, but the issue is not in CISA KEV and no active exploitation is confirmed - it is a moderate, availability-only defect rather than a high-priority emergency.
Opening a crafted MPEG file with smpeg through 2.0.0 can crash the hosting application through a heap out-of-bounds read in MPEGsystem::FillBuffer(). The issue is reachable only when a local user opens an attacker-controlled file via SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data, and the assessed impact is availability-only denial of service. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation.
An MPEG system header that declares an undersized packet length causes an integer underflow in stream_header() in MPEGsystem.cpp, wrapping packet_size and letting a crafted file crash any application built on smpeg through version 2.0.0. The attack is local (AV:L) and requires a victim to open the hostile MPEG file through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data, so exploitation is limited to denial of service via reachable assertion or out-of-bounds copy; there is no path to code execution or data exposure in the assessed impact. Publicly available exploit code exists, but the issue is not in CISA KEV and no active exploitation is confirmed - it is a moderate, availability-only defect rather than a high-priority emergency.
Opening a crafted MPEG file with smpeg through 2.0.0 can crash the hosting application through a heap out-of-bounds read in MPEGsystem::FillBuffer(). The issue is reachable only when a local user opens an attacker-controlled file via SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data, and the assessed impact is availability-only denial of service. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation.