Live › vulnerability › CVE-2026-112009
Go to dashboardsmpeg, a legacy MPEG decoding library, reads past a 16384-byte heap buffer in MPEGsystem::FillBuffer() when an MPEG file has a crafted system header stream table. The sources report the crash as the practical effect when an application opens such a file through SMPEG_new, SMPEG_new_rwops or SMPEG_new_data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that open MPEG files with smpeg through SMPEG_new, SMPEG_new_rwops or SMPEG_new_data are exposed, because the flaw is in parsing untrusted input. Systems that never decode MPEG files with smpeg, or that only handle trusted media, have little reason to act. The sources do not say whether a fixed version exists.
No product ranges from the sources yet.
SMPEG_new).2.0.0 are affected.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashes applications opening it through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data.
This page as .md · .json · in your agent: get_signal("CVE-2026-112009")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.