Description

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer overflow when the file is parsed with mkvmerge.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-13T13:16:29.560Z",
  "pubdate": "2026-09-13T13:16:29.560Z",
  "executiveSummary": "MKVToolNix through version 101.0 is susceptible to a critical heap-based buffer overflow vulnerability residing within the bundled avilib library.\nThe flaw originates from an integer wraparound condition during the parsing of ODML superindex structures within AVI files.\nAn unauthenticated, remote attacker can exploit this vulnerability by providing a specifically crafted malicious AVI file to the mkvmerge utility.\nSuccessful exploitation facilitates arbitrary code execution or application crashes, posing a significant security risk to systems that automatically process untrusted AVI media files.\nThe vulnerability requires no specific authentication or elevated privileges, relying solely on the victim invoking the affected parsing functionality on the malformed input.\nGiven the nature of the overflow, the integrity and availability of the host process are compromised, potentially allowing for full system compromise depending on the execution context.",
  "technicalDetails": "The vulnerability is localized within the avilib library, which is integrated into the MKVToolNix suite for handling AVI file format parsing. The root cause is an integer wraparound condition occurring during 32-bit arithmetic operations when calculating memory requirements for the OpenDML (ODML) superindex parser.\nIn the context of the AVI file format, the superindex is used to locate data chunks efficiently. The parser reads an entry count value from the file header to determine the allocation size for an internal heap-based buffer. Due to the lack of sufficient boundary validation on this count field, an attacker can supply an oversized value that, when processed by 32-bit integer arithmetic, triggers a wraparound.\nThis arithmetic failure results in the allocation of a memory buffer significantly smaller than what is required to hold the subsequent data payload parsed from the file. During the subsequent copy operation, the parser writes beyond the boundaries of the undersized heap buffer, resulting in a heap-based buffer overflow.\nThe attack flow proceeds as follows: First, the attacker generates a malicious AVI container where the ODML superindex index_entry_count or related metadata is manipulated to cause an integer overflow. Second, the attacker entices the victim to process this file using mkvmerge, a core component of MKVToolNix. Third, when mkvmerge invokes the vulnerable avilib parsing routine, the library performs the faulty memory allocation. Finally, as the parser proceeds to read and copy index entries from the file into the heap buffer, the heap memory is corrupted.\nThe overflow enables an attacker to overwrite adjacent memory structures on the heap. Depending on the memory layout and the specific target application, this can be leveraged to overwrite function pointers or other critical control flow objects, leading to arbitrary code execution within the security context of the user running mkvmerge. The vulnerability does not require prior authentication or network connectivity, as the exploit is triggered locally upon the file's ingestion. All versions of MKVToolNix up to and including 101.0 are confirmed as vulnerable. Post-exploitation, an attacker could achieve persistent access or execute arbitrary commands with the user's privileges."
}