MediaInfoLib from MediaArea includes a heap‑based buffer overflow in the parsing of the LXF element. This flaw can corrupt memory when a specially crafted media file is processed, potentially leading to arbitrary code execution or a denial‑of‑service crash. The description does not detail a confirmed exploitation path, but heap overflows in parsing libraries typically allow attackers to execute code or cause process termination if the vulnerable media file is opened by an application that uses the library.

The vulnerability affects MediaArea’s MediaInfoLib library. No specific affected versions are listed, so all releases that contain the LXF parsing functionality are potentially vulnerable until a patch is issued. Users should consult MediaArea’s release notes or product documentation to verify whether their installed version includes the fix.

The CVSS score of 7.8 indicates high severity, and although the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the potential for arbitrary code execution through improperly validated media files makes the risk significant. Attackers are likely to exploit this flaw by delivering malicious media to an application that uses the library; the lack of public exploit data suggests the CVE has not yet been widely leveraged, but the high CVSS reflects the catastrophic impact if successful.