This vulnerability (CVE-2026-22554) is a heap-based buffer overflow (CWE-122) in MediaInfoLib version 26.01 by MediaArea, occurring during channel splitting operations. The flaw allows an attacker with local access and user interaction to potentially execute arbitrary code or cause denial of service by corrupting heap memory. The CVSS 3.1 vector indicates local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution or denial of service on affected systems, impacting confidentiality, integrity, and availability of the system running MediaInfoLib 26.01. The vulnerability requires local access and user interaction, which limits remote exploitation potential. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted media files with MediaInfoLib 26.01 and consider restricting local user access to vulnerable versions. Monitor vendor channels for updates and apply patches promptly once available.