VDB
CVE-2026-90783
CVE-2026-90783
PUBLISHED
CVSS 7.8 HIGH
Reported by VulnCheck · Published September 13, 2026
MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer overflow when the file is parsed with mkvmerge.
Risk Scores
CVSS 3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Moritz Bunkus | MKVToolNix | 0, 1495126138e086080f0163bee27fafbdf956a1d0 |
| alpine | mkvtoolnix | 0, 0, 0 |
| Moritz Bunkus | MKVToolNix | 0, 1495126138e086080f0163bee27fafbdf956a1d0, 0 |
Timeline
- Sep 13, 2026 Coalition ESS Score
- Sep 13, 2026 CVE Published
- Sep 14, 2026 EPSS Score
- Sep 14, 2026 CVE Updated
References
- Patch Commit patch
- Unchecked video superindex allocation in avi_parse_input_file() at release-101.0 technical-description
- product
- VulnCheck Advisory: MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound third-party-advisory