CVE-2026-25713
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version 26.01). A specially crafted media file containing ID3v2 tags can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Risk Assessment
An attacker could exploit the vulnerability to execute arbitrary code in the context of the application using MediaInfoLib, potentially leading to system compromise or control.
Recommendation
Upgrade MediaInfoLib to a patched version and avoid processing untrusted files with ID3v2 tags.
Other vulnerabilities in MediaInfoLib
See all- CVE-2026-25104High
A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- CVE-2026-28764High
A heap-based buffer overflow vulnerability exists in the LXF element parsing functionality of MediaInfoLib (version 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- CVE-2026-22554High
A heap-based buffer overflow vulnerability exists in the Channel Splitting functionality of MediaInfoLib (version 26.01). A specially crafted .riff file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Original NVD description (English source)
A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted media file that contains ID3v2 tags can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS