CVE Alert: CVE-2026-90783 – Moritz Bunkus

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library’s ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer overflow when the file is parsed with mkvmerge.

Treat this as a high-risk workstation and media-processing vulnerability, with expedited remediation; exploitation urgency cannot be fully ranked because KEV, SSVC and EPSS data are not provided.

A malicious media file could crash the processing application and, in favourable conditions, enable code execution with the rights of the user or automation account. The most realistic attacker goals are workstation compromise, theft of accessible data, disruption of media-transcoding workflows, or use of a trusted processing host as an initial foothold.

### Most likely attack path

An attacker supplies or induces handling of a crafted local file through downloads, email attachments, shared folders, content-ingestion queues or automated conversion pipelines. Exploitation requires no application privileges and has low complexity, but user or process interaction is necessary; Scope is unchanged, so direct impact is confined to the vulnerable process and its permissions, although those permissions may enable subsequent lateral movement.

### Who is most exposed

Prioritise analysts, content teams, developers and servers that automatically ingest or convert untrusted video, particularly shared services processing files from external contributors.

Alert on unusual crashes or restarts of the media-processing executable.

Monitor child-process creation, shell invocation and unexpected network connections.

Inspect file-ingestion logs for anomalous AVI files or extreme metadata counts.

Review endpoint telemetry for newly written executables, persistence or credential access after processing.

### Mitigation and prioritisation

Apply the vendor patch or upgrade to a fixed build as soon as change controls permit.

Treat untrusted media as hostile; quarantine and validate files before processing.

Run automated conversion in a sandbox or isolated, least-privileged service account.

Restrict outbound access from processing hosts and disable unnecessary file sharing.

Confirm KEV, SSVC and EPSS status before final queue placement; their absence here leaves exploitation likelihood uncertain.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.