Description
MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer overflow when the file is parsed with mkvmerge.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Moritz Bunkus MKVToolNix
Default version status: unaffected
0 to ≤ 101.0affected1495126138e086080f0163bee27fafbdf956a1d0unaffected
References
- https://codeberg.org/mbunkus/mkvtoolnix/commit/1495126138e086080f0163bee27fafbdf956a1d0 ↗
- https://codeberg.org/mbunkus/mkvtoolnix/src/tag/release-101.0/lib/avilib-0.6.10/avilib.c#L2552-L2570 ↗
- https://codeberg.org/mbunkus/mkvtoolnix ↗
- https://www.vulncheck.com/advisories/mkvtoolnix-through-101.0-heap-buffer-overflow-via-avilib-odml-superindex-integer-wraparound ↗
- https://lists.debian.org/debian-lts-announce/2026/09/msg00040.html ↗