MediaArea MediaInfoLib version 26.01 contains an integer underflow vulnerability (CWE-191) in its LXF parsing functionality. This flaw can cause a heap-based buffer overflow, potentially allowing an attacker with local access and user interaction to execute arbitrary code or cause a denial of service. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability has been publicly disclosed but no vendor advisory or patch information is available yet.

Successful exploitation of this vulnerability can lead to arbitrary code execution or denial of service due to heap-based buffer overflow. The impact affects confidentiality, integrity, and availability of the affected system. Exploitation requires local access with user interaction, limiting remote attack feasibility. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted LXF files with MediaInfoLib version 26.01 and restrict local access to trusted users only.