Executive brief
MediaInfoLib, a library used to extract technical data and metadata from video and audio files, is vulnerable to a memory corruption flaw when processing LEITCH (.lxf) video files. By tricking a user into opening a specially crafted malicious file, an attacker could potentially execute unauthorized code on the system. This could lead to a full system compromise or the theft of sensitive information.
Technical details
A heap-based buffer overflow exists in MediaInfoLib 26.01 within the LXF (LEITCH video format) parsing functionality, specifically in the `File_ChannelGrouping::Read_Buffer_Continue()` function. The vulnerability is rooted in an integer underflow (CWE-191) occurring during the audio channel merging process. When processing a 20-bit depth stream, the `Minimum` variable (derived from user-controlled buffer sizes) can be decremented past zero, resulting in a massive unsigned integer value. This causes a `while` loop to continue indefinitely, overwriting heap memory beyond the allocated 32,768-byte buffer. An attacker can leverage this to overwrite adjacent memory structures, including the `BitDepth` variable and subsequent pointers, to achieve arbitrary code execution. Exploitation requires a user to open a malicious .lxf file.
Affected products
- MediaArea MediaInfoLib 26.01
Timeline
- 2026-05-25: advisory: Initial disclosure by Cisco Talos (TALOS-2026-2367)
- 2026-05-26: disclosed: NVD publication date