This vulnerability (CVE-2026-28764) in MediaArea MediaInfoLib 26.01 arises from improper handling of pointer offsets when parsing LXF elements, resulting in a heap-based buffer overflow (CWE-823). The flaw allows an attacker with local access and user interaction to potentially execute arbitrary code or cause denial of service. The CVSS 3.1 score is 7.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability due to heap-based buffer overflow. The attacker requires local access and user interaction to trigger the flaw. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted LXF files with MediaInfoLib 26.01 and consider restricting local user access to vulnerable versions. Monitor vendor communications for updates on patches or mitigations.