MediaInfoLib LXF Parsing Heap Overflow: High-Severity Vulnerability Disclosed

The National Vulnerability Database has disclosed CVE-2026-28764, a high-severity heap-based buffer overflow vulnerability in MediaArea MediaInfoLib’s LXF element parsing. Rated 7.8 CVSSv3.1, this flaw could lead to arbitrary code execution or denial-of-service, posing a significant risk to systems processing media files.

The vulnerability stems from improper handling of LXF media files, allowing an attacker to craft a malicious file that overflows a buffer when parsed by MediaInfoLib. The attack vector is local, requiring user interaction (UI:R), meaning a victim would need to open or process a malicious media file. However, the impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H), indicating a severe compromise if exploited.

While specific affected products are not detailed by the National Vulnerability Database, organizations utilizing MediaInfoLib in their media processing pipelines, content management systems, or any application that parses LXF files should consider this a critical alert. This includes any service that automatically processes user-submitted media, as an attacker could embed the exploit within a seemingly innocuous file.