Description
smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashes applications opening it through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data.
Published: 2026-10-18
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

smpeg through version 2.0.0 contains a heap out-of-bounds read vulnerability in the MPEGsystem::FillBuffer() function. By supplying a crafted system header stream table where all bytes have the high bit set, attackers can read beyond the intended 16,384‑byte buffer, potentially exposing memory contents and causing the application to crash when using SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data.

Affected Systems

ICculus smpeg, versions up to and including 2.0.0

Risk and Exploitability

The CVSS score of 6.8 indicates a medium severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a low to moderate likelihood of widespread exploitation under current intelligence. The most plausible attack vector involves an attacker providing a malicious MPEG file that is processed by an application using smpeg, which could be locally or remotely delivered depending on how the application accepts media input. Exploitation requires that the application load the file through one of the SMPEG interfaces, causing a bounds checking failure and a crash.

Generated by OpenCVE AI on October 18, 2026 at 12:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade smpeg to a patched release that eliminates the out-of-bounds read.
  • Restrict processing of MPEG files to trusted sources and refuse files where the system header stream table bytes all have the high bit set.
  • Implement bounds checking in application code to validate the stream table length and content before passing it to SMPEG functions, ensuring the buffer size never exceeds 16,384 bytes.

Generated by OpenCVE AI on October 18, 2026 at 12:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Icculus
Icculus smpeg
Vendors & Products Icculus
Icculus smpeg

Sun, 18 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 18 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashes applications opening it through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data.
Title smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Icculus Smpeg
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-18T12:23:31.861Z

Reserved: 2026-10-18T01:23:46.084Z

Link: CVE-2026-112009

cve-icon Vulnrichment

Updated: 2026-10-18T12:19:07.229Z

cve-icon NVD

Status : Deferred

Published: 2026-10-18T12:17:13.383

Modified: 2026-10-19T21:14:14.150

Link: CVE-2026-112009

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:53:24Z

Weaknesses