CVE-2026-22554
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A heap-based buffer overflow vulnerability exists in the Channel Splitting functionality of MediaInfoLib (version 26.01). A specially crafted .riff file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Risk Assessment
An attacker could exploit the vulnerability to execute arbitrary code in the context of the application using MediaInfoLib, potentially leading to system compromise or control.
Recommendation
Upgrade MediaInfoLib to a patched version and avoid processing untrusted .riff files.
Other vulnerabilities in MediaInfoLib
See all- CVE-2026-25713High
A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version 26.01). A specially crafted media file containing ID3v2 tags can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- CVE-2026-25104High
A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- CVE-2026-28764High
A heap-based buffer overflow vulnerability exists in the LXF element parsing functionality of MediaInfoLib (version 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Original NVD description (English source)
A heap-based buffer overflow vulnerability exists in the Channel Splitting functionality of MediaInfoLib (version(s): 26.01). A specially crafted .riff file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS