CVE-2026-112009: smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer
smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashes applications opening it through SMPEGnew, SMPEGnewrwops, or SMPEGnewdata.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications that open attacker-supplied MPEG files through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data are exposed. The reported impact is a crash caused by reading past a 16384-byte heap buffer.
What must an attacker provide to trigger the crash?
An attacker needs to supply a crafted MPEG file containing a system header stream table whose bytes all have the high bit set. User interaction is required because the vulnerable application must open the file.
Is authentication or prior access required to exploit this?
No privileges are required. The attacker only needs a way to cause the application to process the crafted MPEG input.