Back Linuxsecurity

Fedora 44 Mkvtoolnix Critical Heap Overflow Fix 2026

Linuxsecurity •LinuxSecurity Advisories • October 13, 2026

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

Mkvtoolnix is a set of utilities to mux and demux audio, video and subtitle

streams into and from Matroska containers.

Latest mkvtoolnix stable update (changes: with the fix for CVE-2026-90783. Includes required updates of libebml and libmatroska.

* Sun Oct 11 2026 Dominik 'Rathann' Mierzejewski - 102.0-1 - update to 102.0 (resolves rhbz#2523158) - libEBML v1.4.7 & libMatroska v1.7.2 are now required. - The meta info file `org.bunkus.mkvtoolnix-gui.appdata.xml` was renamed to `org.bunkus.mkvtoolnix-gui.metainfo.xml`. * Thu Jul 16 2026 Dominik 'Rathann' Mierzejewski - 100.0-1 - update to 100.0 (resolves rhbz#2497182) - icons are now SVG only. * Thu Jul 16 2026 Fedora Release Engineering - 99.0-3 - Rebuilt for * Thu Jun 25 2026 František Zatloukal - 99.0-2 - Rebuilt for fmt/spdlog

[ 1 ] Bug #2532925 - CVE-2026-90783 mkvtoolnix: MKVToolNix: Heap buffer overflow in avilib when parsing malicious AVI files. [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-b56cbfe203' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Heap Overflow Vulnerability in Fedora's Mkvtoolnix and Dependencies A heap overflow vulnerability (CVE-2026-90783) has been identified in Mkvtoolnix, affecting Fedora 44 and earlier versions. This vulnerability allows attackers to execute arbitrary code by exploiting malformed AVI files. The flaw impacts Mkvtoolnix, libebml, and libmatroska libraries, which are essential for handling multimedia files. The vulnerability was disclosed on September 13, 2026, with a CVSS score of 7.8, indicating a high severity. Patches have been released for Fedora 44 and earlier versions, with updates available via the 'dnf' package manager. Users are urged to apply these updates promptly to mitigate risks. The updates include changes to required library versions and address the heap overflow issue. The vulnerability is currently not reported as being in the wild. 5 sources 63

Extracted Entities

Fedora 44 Mkvtoolnix Critical Heap Overflow Fix 2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)