Executive brief
MKVToolNix is a widely-used tool for creating and processing Matroska media files. The bundled avilib library contains a heap buffer overflow vulnerability in its ODML superindex parser that can be triggered by a specially crafted AVI file. An attacker can exploit this flaw by distributing a malicious AVI file that, when processed by mkvmerge, causes a denial of service or potentially arbitrary code execution.
Technical details
The vulnerability is a heap buffer overflow in the bundled avilib library's ODML superindex parser, caused by integer wraparound in 32-bit arithmetic. An attacker crafts a malicious AVI file with oversized entry count fields that causes integer overflow during size calculations, resulting in an undersized heap allocation. When mkvmerge parses such a file, the parser writes beyond the allocated buffer boundaries. This requires the victim to actively process the malicious AVI file with mkvmerge, but no special privileges or authentication are needed. The flaw affects all versions through 101.0; a patch was committed to the repository on 2026-08-25.
Affected products
- MKVToolNix MKVToolNix through 101.0
Timeline
- 2026-09-13: disclosed
- 2026-08-25: patched: Guard added in avilib to prevent heap overflow due to integer multiplication wrapping