MediaArea's MediaInfoLib contains a heap-based buffer overflow that occurs when parsing files with the LXF format. The flaw allows an attacker to provide a crafted LXF file that overflows a heap buffer, potentially leading to arbitrary code execution. This weakness, classified as CWE-191, can compromise the confidentiality, integrity, and availability of systems that load malicious LXF files.

The affected product is MediaArea MediaInfoLib. No version information is provided, so any installation that uses the LXF parsing component may be vulnerable until a patch becomes available.

The vulnerability carries a CVSS score of 7.8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be the execution of a malicious LXF file, either through local file modification or external file injection into an application that processes LXF data. No public exploit has been disclosed as of the information provided.