CVE-2026-90783: Integer Overflow to Buffer Overflow in Moritz Bunkus MKVToolNix
MKVToolNix up to version 101.0 contains a heap buffer overflow vulnerability in the avilib library's ODML superindex parser. This occurs due to an integer overflow in 32-bit arithmetic that leads to an undersized heap allocation when parsing crafted AVI files with oversized entry counts. The vulnerability can be triggered when parsing malicious files with mkvmerge, potentially resulting in heap corruption.
AI Analysis
Technical Summary
CVE-2026-90783 is a heap buffer overflow vulnerability in MKVToolNix through version 101.0. The flaw exists in the bundled avilib library's ODML superindex parser, where an integer wraparound in 32-bit arithmetic causes an undersized heap allocation. Attackers can exploit this by crafting AVI files with oversized entry counts, leading to a heap buffer overflow during parsing with mkvmerge.
Potential Impact
Successful exploitation can lead to heap corruption, which may allow an attacker to execute arbitrary code, cause denial of service, or crash the application. The CVSS 3.1 score is 7.8 (high), reflecting the potential for high confidentiality, integrity, and availability impact. However, there are no known exploits in the wild at this time.
Mitigation Recommendations
No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or malicious AVI files with mkvmerge.
CVE-2026-90783: Integer Overflow to Buffer Overflow in Moritz Bunkus MKVToolNix
Description
MKVToolNix up to version 101.0 contains a heap buffer overflow vulnerability in the avilib library's ODML superindex parser. This occurs due to an integer overflow in 32-bit arithmetic that leads to an undersized heap allocation when parsing crafted AVI files with oversized entry counts. The vulnerability can be triggered when parsing malicious files with mkvmerge, potentially resulting in heap corruption.
CVSS v3.1
Score 7.8high
Affected software
Moritz Bunkus
MKVToolNix
pkg:github/mbunkus/mkvtoolnixRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90783 is a heap buffer overflow vulnerability in MKVToolNix through version 101.0. The flaw exists in the bundled avilib library's ODML superindex parser, where an integer wraparound in 32-bit arithmetic causes an undersized heap allocation. Attackers can exploit this by crafting AVI files with oversized entry counts, leading to a heap buffer overflow during parsing with mkvmerge.
Potential Impact
Successful exploitation can lead to heap corruption, which may allow an attacker to execute arbitrary code, cause denial of service, or crash the application. The CVSS 3.1 score is 7.8 (high), reflecting the potential for high confidentiality, integrity, and availability impact. However, there are no known exploits in the wild at this time.
Mitigation Recommendations
No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or malicious AVI files with mkvmerge.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-13T12:01:36.028Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa71fe155bf5e2cf521a4ee
Added to database: 09/13/2026, 22:12:49 UTC
Last enriched: 09/13/2026, 22:14:52 UTC
Last updated: 09/14/2026, 02:07:31 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.