A heap‑based buffer overflow exists in the Channel Splitting routine of MediaInfoLib. The vulnerability allows an attacker to supply a specially crafted .riff file that can overwrite adjacent memory and trigger arbitrary code execution. The weakness falls under bounds‑check failure (CWE‑122).

The affected product is MediaInfoLib (version 26.01) from MediaArea. Any application that embeds this library and processes media files—such as media players, editors, or transcoding tools—could be impacted when a malicious .riff file is parsed.

With a CVSS score of 7.8 the risk is significant. The EPSS score of < 1 % indicates a currently low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply or trick a user into opening a malicious media file that contains a crafted channel‑splitting structure; the resulting heap corruption could allow arbitrary code execution in the process hosting MediaInfoLib.