CVE-2026-112010: smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp
smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader() in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable assertion or out-of-bounds copy, crashing the application.
Affected Software
Event History
Frequently Asked Questions
What attacker access is required to trigger the flaw?
An attacker needs to get a crafted MPEG file opened by the application through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data. The attack requires user interaction to open the malicious file, but no privileges are required.
What is the practical impact?
A malformed undersized packet length can cause packet_size to wrap in stream_header(). This can reach an assertion failure or an out-of-bounds copy and crash the application.
Which deployments are exposed?
Applications using SMPEG through version 2.0.0 are affected when they open attacker-controlled MPEG content through one of the affected SMPEG loading interfaces.