Description
A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted media file that contains ID3v2 tags can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Published: 2026-05-26
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in MediaInfoLib is a heap-based buffer overflow in the parsing routine for ID3v2 tags. A specially crafted media file containing malicious ID3v2 metadata can trigger the overflow, giving an attacker the ability to inject and execute arbitrary code within the process that is using the library.

Affected Systems

This flaw affects MediaArea's MediaInfoLib library, specifically version 26.01. Any installation that links to this exact version is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.8 places the vulnerability in the high severity range, while an EPSS score of less than 1 % indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to supply a crafted media file that is parsed by the library; if the library is used in a media server or player that accepts network input, remote exploitation is possible; otherwise the risk is limited to users who can place malicious files into the environment.

Generated by OpenCVE AI on September 23, 2026 at 16:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a patched release of MediaInfoLib when one becomes available.
  • If no patch is available, do not allow the library to parse untrusted media files, strip or remove ID3v2 tags before processing, or disable ID3v2 parsing if the application permits.
  • Run any media processing that includes the library in a sandbox or with reduced privileges to contain the impact of a potential exploit.

Generated by OpenCVE AI on September 23, 2026 at 16:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Title Heap Buffer Overflow in MediaInfoLib ID3v2 Parsing

Wed, 23 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Description MediaArea MediaInfoLib ID3v2 parsing heap buffer overflow vulnerability A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted media file that contains ID3v2 tags can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Thu, 28 May 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Mediaarea mediainfolib
CPEs cpe:2.3:a:mediaarea:mediainfolib:26.01:*:*:*:*:*:*:*
Vendors & Products Mediaarea mediainfolib

Wed, 27 May 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Mediaarea
Mediaarea mediainfo
Vendors & Products Mediaarea
Mediaarea mediainfo

Tue, 26 May 2026 13:45:00 +0000

Type Values Removed Values Added
References

Tue, 26 May 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 26 May 2026 10:30:00 +0000

Type Values Removed Values Added
Title Heap Buffer Overflow in MediaInfoLib ID3v2 Parsing

Tue, 26 May 2026 09:00:00 +0000

Type Values Removed Values Added
Description MediaArea MediaInfoLib ID3v2 parsing heap buffer overflow vulnerability
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Mediaarea Mediainfo Mediainfolib
cve-icon MITRE

Status: PUBLISHED

Assigner: talos

Published:

Updated: 2026-09-23T12:00:53.126Z

Reserved: 2026-02-12T16:25:35.521Z

Link: CVE-2026-25713

cve-icon Vulnrichment

Updated: 2026-05-26T09:08:22.909Z

cve-icon NVD

Status : Modified

Published: 2026-05-26T09:16:19.533

Modified: 2026-09-23T13:17:27.527

Link: CVE-2026-25713

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T16:30:08Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow