CVE-2026-90783

MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound

Published Sep 13, 2026 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Description

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer overflow when the file is parsed with mkvmerge.

Analysis

Technical impact

MKVToolNix versions up to 101.0 embed the avilib library, which parses ODML superindex structures in AVI files. A 32‑bit integer wraparound in the array length calculation causes an undersized heap allocation when a malicious AVI file contains an oversized entry count. When mkvmerge processes such a file, the resulting heap buffer overflow can corrupt program memory, cause a crash, or potentially lead to arbitrary code execution on the host system.

Affected Systems

The vulnerability affects all releases of Moritz Bunkus’ MKVToolNix through version 101.0. Versions newer than 101.0 incorporate the upstream fix that removes the vulnerable parsing code and are not susceptible.

Risk and Exploitability

The CVSS score of 8.5 classifies this flaw as high severity, while the EPSS score indicates a very low but non‑zero probability of exploitation; it is not listed in the CISA KEV catalog. The likely attack vector is local file exploitation, requiring an attacker to supply a crafted AVI file that mkvmerge parses. If the adversary can influence the file input remotely, the threat could extend to a remote execution scenario.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Moritz Bunkus

MKVToolNix

unaffected

Version	Status	Constraints
`0`	affected	≤ 101.0
`1495126138e086080f0163bee27fafbdf956a1d0`	unaffected	—

No data.

Vendor Product Versions

Moritz Bunkus

Mkvtoolnix

Version	Status	Scheme	Platform
`[0,101.0]`	affected	generic	—
`1495126138e086080f0163bee27fafbdf956a1d0`	unaffected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest MKVToolNix release (any version newer than 101.0 contains the official fix that removes the vulnerable parsing code.
If an upgrade cannot be performed immediately, restrict mkvmerge to process only AVI files from trusted or internal sources, and execute the tool under a least‑privilege account or in a sandboxed environment.
Implement a pre‑processing check that parses the ODML superindex entry count of incoming AVI files and rejects any that exceed a safe threshold before passing them to mkvmerge.

Generated by OpenCVE AI on September 15, 2026 at 17:52 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4805-1	mkvtoolnix security update
Debian DSA	DSA-6502-1	mkvtoolnix security update

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.202% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://codeberg.org/mbunkus/mkvtoolnix
https://codeberg.org/mbunkus/mkvtoolnix/commit/1495126138e086080f0163bee27fafbdf956a1d0
https://codeberg.org/mbunkus/mkvtoolnix/src/tag/release-101.0/lib/avilib-0.6.10/avilib.c#L2552-L2570
https://lists.debian.org/debian-lts-announce/2026/09/msg00040.html
https://www.vulncheck.com/advisories/mkvtoolnix-through-101.0-heap-buffer-overflow-via-avilib-odml-superindex-integer-wraparound

History

Sep 30, 2026 8:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2026/09/msg00040.html

Sep 14, 2026 9:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Moritz Bunkus Moritz Bunkus mkvtoolnix
Vendors & Products		Moritz Bunkus Moritz Bunkus mkvtoolnix

Sep 13, 2026 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer overflow when the file is parsed with mkvmerge.
Title		MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound
Weaknesses		CWE-680
References		https://codeberg.org/mbunkus/mkvtoolnix https://codeberg.org/mbunkus/mkvtoolnix/commit/1495126138e086080f0163bee27fafbdf956a1d0 https://codeberg.org/mbunkus/mkvtoolnix/src/tag/release-101.0/lib/avilib-0.6.10/avilib.c#L2552-L2570 https://www.vulncheck.com/advisories/mkvtoolnix-through-101.0-heap-buffer-overflow-via-avilib-odml-superindex-integer-wraparound
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`