CVE-2026-25104

Vulnerability

In MediaInfoLib version 26.01, the LXF parsing functionality contains a heap-based buffer overflow due to an integer underflow (CWE-191). When merging audio channels, the code calculates Minimum by subtracting Buffer_Offset from Buffer_Size for each channel [1]. If Buffer_Offset is larger than Buffer_Size, the subtraction wraps around to a very large value, causing subsequent memory copy operations to overflow the heap buffer [1].

Exploitation

An attacker must craft a malicious .lxf file that sets audio channel parameters such that Buffer_Offset exceeds Buffer_Size, triggering the integer underflow. The victim needs to open the file with MediaInfoLib (e.g., via MediaInfo or an application using the library) [1]. No prior authentication or network access is required; the attack is local with user interaction.

Impact

Successful exploitation leads to arbitrary code execution in the context of the user running the application. This can result in full compromise of confidentiality, integrity, and availability (CVSS 7.8) [1].

Mitigation

As of the publication date (2026-05-26), no fix has been released for MediaInfoLib 26.01. Users are advised to avoid parsing untrusted .lxf files until a patched version is available [1].