CVE-2026-25713

Vulnerability

MediaInfoLib version 26.01 contains a heap-based buffer overflow vulnerability in the ID3v2 tag parsing functionality, specifically in File_Id3v2.cpp when handling the Unsynchronization scheme. The parser searches for 0xFF00 patterns and stores indices in Unsynch_List, then reads a DataLength field and allocates a buffer. A specially crafted file can cause a buffer overflow due to improper handling of unsynchronization bytes [1].

Exploitation

An attacker must provide a malicious media file containing crafted ID3v2 tags with the Unsynchronization flag set. The victim must open the file with a vulnerable version of MediaInfoLib (26.01). No authentication or special privileges are required; user interaction is limited to opening the file. The overflow occurs during the unsynchronization decoding process, leading to arbitrary code execution [1].

Impact

Successful exploitation allows arbitrary code execution with the privileges of the user opening the file. This can lead to full compromise of confidentiality, integrity, and availability, as indicated by the CVSS v3 score of 7.8 (High) [1].

Mitigation

As of the publication date (2026-05-26), no fix has been disclosed by the vendor. Users should avoid processing untrusted media files with MediaInfoLib version 26.01 until a patch is released. Monitor the vendor's repository at https://github.com/MediaArea/MediaInfoLib for updates [1].