Executive brief
MediaInfoLib, a widely used library for analyzing technical and tag data of video and audio files, contains a security vulnerability in how it processes LXF media files. If a user is tricked into opening a specially crafted, malicious video file using an application that relies on this library, an attacker could potentially execute unauthorized code or crash the application. This could lead to a full system compromise or the theft of sensitive information handled by the affected software.
Technical details
A heap-based buffer overflow vulnerability exists in MediaArea MediaInfoLib due to improper validation of LXF elements during file parsing. The flaw is categorized as a 'Use of Out-of-range Pointer Offset' (CWE-823), where the library fails to properly bound-check data when processing LXF files. An attacker can exploit this by providing a malformed LXF file to an application using the library. Successful exploitation requires a user to open the malicious file (User Interaction) and can result in arbitrary code execution or a denial-of-service condition. The vulnerability was identified by Cisco Talos and assigned CVE-2026-28764.
Affected products
- MediaArea MediaInfoLib
Timeline
- 2026-05-21: advisory: NVD and Talos published the vulnerability details.