MediaInfoLib heap overflows enable remote code execution

Cisco Talos’ Vulnerability Discovery & Research team reported four heap-based buffer overflow flaws in MediaInfoLib version 26.01 on May 27, 2026. The issues are tracked as TALOS-2026-2367 (CVE-2026-25104), TALOS-2026-2368 (CVE-2026-25713), TALOS-2026-2371 (CVE-2026-28764) and TALOS-2026-2374 (CVE-2026-22554). Talos notes that each vulnerability can lead to arbitrary code execution when a vulnerable application processes a crafted media file.

The vulnerabilities were discovered by researcher Dimitrios Tatsis of Cisco Talos. MediaInfoLib is an open-source library from MediaArea that provides metadata extraction and a user interface for technical and tag information in audio and video files. Because the library parses file contents, specially crafted media files can trigger memory corruption when opened or processed by software that includes the library.

An attacker could deliver a malicious file by download, email attachment or removable media. If an application linked to the vulnerable library processes such a file, the overflow may allow execution of attacker-supplied instructions at the privilege level of the affected application, according to Talos.

MediaArea has released patches for the affected releases. Cisco Talos posted vulnerability advisories and followed its third-party disclosure policy in coordinating the fixes. Talos recommends that organizations apply the vendor updates promptly and verify that software using MediaInfoLib has been updated to the patched version.

Snort intrusion detection coverage that can detect exploitation attempts is available; users can obtain the latest rule sets from Snort.org and view technical details and detection guidance on the Talos Intelligence website. Talos’ advisories include technical indicators and guidance to help administrators identify attempted exploitation and mitigate risk.

The report credits Dimitrios Tatsis for the discovery and provides the four CVE identifiers for reference. Administrators and users of software that incorporate MediaInfoLib are advised to treat untrusted media files with caution until updates have been applied.