MediaInfoLib from MediaArea has a heap‑based buffer overflow in its LXF element parsing functionality. The flaw arises when a specially crafted .lxf file is processed, causing memory corruption that can lead to arbitrary code execution or a denial‑of‑service crash. The description, which cites version 26.01, confirms an attacker can trigger the vulnerability by providing a malicious file.

The vulnerability affects MediaArea’s MediaInfoLib library. The updated description identifies version 26.01 as affected, while other releases that include the LXF parsing capability remain potentially vulnerable until patched. Users should verify their installed version against MediaArea’s release notes or product documentation to confirm if the patch has been applied.

The CVSS score of 7.8 indicates high severity, and the EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the potential for arbitrary code execution through improperly validated media files makes the risk significant. Attackers could deliver malicious .lxf files to any application that uses MediaInfoLib; the lack of public exploit data suggests the CVE has not yet been widely leveraged, yet the high CVSS reflects the catastrophic impact if successful.