Heap Out-of-Bounds Read in SMPEG Library

Executive Summary

CVE-2026-112009 is a heap out-of-bounds read vulnerability in the smpeg library through version 2.0.0. It occurs in the MPEGsystem::FillBuffer() function when parsing a crafted MPEG file. Attackers can trigger this by setting all stream table bytes to have the high bit set, causing the application to read past a 16384-byte buffer. This leads to crashes in programs using SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for MPEG files with malformed system headers. Use tools like Wireshark to filter for MPEG traffic and analyze file headers for high-bit set bytes in stream tables. On systems using smpeg, check for crashes when processing MPEG files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using the smpeg library to crash when processing malicious MPEG files. It may also expose heap memory, leading to denial-of-service conditions or potential information leaks. The impact depends on the specific vulnerability triggered and the platform.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes crashes or denial-of-service conditions in applications using smpeg, which could disrupt data processing workflows. While it may lead to information leaks in some cases, there is no direct evidence linking it to compliance violations with GDPR or HIPAA. However, crashes in systems handling sensitive data could indirectly impact availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update smpeg to a patched version beyond 2.0.0. If updating is not possible, restrict access to MPEG files from untrusted sources and disable smpeg-based applications until patched. Monitor systems for crashes during MPEG file processing.

Useful 0 Not Useful 0