{"id":"CVE-2026-112009","kind":"vulnerability","aliases":["CVE-2026-112009"],"related":[],"title":"smpeg: crafted MPEG file triggers heap out-of-bounds read and crash","description":"smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashes applications opening it through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data.","summary":"smpeg, a legacy MPEG decoding library, reads past a 16384-byte heap buffer in MPEGsystem::FillBuffer() when an MPEG file has a crafted system header stream table. The sources report the crash as the practical effect when an application opens such a file through SMPEG_new, SMPEG_new_rwops or SMPEG_new_data.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["media-playback","package","sdl","smpeg"],"not_affected_if":["no-untrusted-mpeg-input"],"how_to_check":"- Check whether the project links smpeg or uses SMPEG_new, SMPEG_new_rwops or SMPEG_new_data (e.g. search the source tree for `SMPEG_new`).\n- Check the smpeg version in use; the sources say versions through `2.0.0` are affected.","fix":null,"status":"open","published_at":"2026-10-18T12:17:13+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:45:06+00:00","updated_at":"2026-10-25T03:45:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:45:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"smpeg: crafted MPEG file triggers heap out-of-bounds read and crash","impact":"low","summary":"smpeg, a legacy MPEG decoding library, reads past a 16384-byte heap buffer in MPEGsystem::FillBuffer() when an MPEG file has a crafted system header stream table. The sources report the crash as the practical effect when an application opens such a file through SMPEG_new, SMPEG_new_rwops or SMPEG_new_data.","category":"package","nicknames":[],"who_cares":["smpeg","sdl","media-playback"],"confidence":0.6,"needs_auth":"no","worst_case":"Crafted MPEG file crashes the application decoding it","analyst_note":"Confirm whether a fixed smpeg version or patch exists and whether memory disclosure beyond the crash is possible; the NVD entry is the only source listed.","how_to_check":"- Check whether the project links smpeg or uses SMPEG_new, SMPEG_new_rwops or SMPEG_new_data (e.g. search the source tree for `SMPEG_new`).\n- Check the smpeg version in use; the sources say versions through `2.0.0` are affected.","needs_analyst":true,"not_affected_if":["no-untrusted-mpeg-input"],"who_is_affected":"Applications that open MPEG files with smpeg through SMPEG_new, SMPEG_new_rwops or SMPEG_new_data are exposed, because the flaw is in parsing untrusted input. Systems that never decode MPEG files with smpeg, or that only handle trusted media, have little reason to act. The sources do not say whether a fixed version exists.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000647,"input_tokens":3378,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112009':16A,19A '-2026':15A,18A '16384':35B,101C '2.0.0':81C 'allow':95C 'applic':64B,129C 'attack':96C,112C 'bit':126C 'bound':10A,88C 'buffer':38B,103C 'byte':36B,102C,121C 'contain':82C 'craft':2A,48B,107C 'crash':13A,57B,128C 'cve':14A,17A 'data':78B,141C 'decod':30B 'effect':61B 'file':4A,45B,68B,117C 'fillbuff':41B,93C 'header':50B,109C 'heap':6A,37B,84C 'high':125C 'legaci':28B 'librari':31B 'media':21B 'media-playback':20B 'mpeg':3A,29B,44B,116C 'mpegsystem':40B,92C 'new':71B,73B,77B,134C,136C,140C 'open':65B,130C 'out-of-bound':7A,85C 'packag':23B 'past':33B,99C 'playback':22B 'practic':60B 'provid':114C 'read':11A,32B,89C,98C 'report':55B 'rwop':74B,137C 'sdl':24B 'set':123C 'smpeg':1A,25B,26B,70B,72B,76B,79C,133C,135C,139C 'sourc':54B 'stream':51B,110C,119C 'suppli':105C 'system':49B,108C 'tabl':52B,111C,120C 'trigger':5A 'vulner':90C 'whose':118C","nicknames":[],"mitigations":[],"who_affected":"Applications that open MPEG files with smpeg through SMPEG_new, SMPEG_new_rwops or SMPEG_new_data are exposed, because the flaw is in parsing untrusted input. Systems that never decode MPEG files with smpeg, or that only handle trusted media, have little reason to act. The sources do not say whether a fixed version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112009","severity":null,"published_at":"2026-10-18T12:17:13+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}