CVE-2026-112010 in Smpeg
Summary
by MITRE • 10/18/2026
smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEG_new, SMPEG_new_rwops or SMPEG_new_data to trigger a reachable assertion or out-of-bounds copy, crashing the application.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in smpeg versions through 2.0.0 represents a critical integer underflow flaw located within the stream_header function of the MPEGsystem.cpp source file. This defect arises from insufficient validation of packet length fields when parsing MPEG system streams. Specifically, an attacker can craft an MPEG file where the declared packet size is smaller than expected or structured in a way that causes arithmetic operations involving this value to wrap around due to integer underflow conditions. When such a malformed file is processed by functions like SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data, the application fails to correctly interpret the buffer boundaries, leading to severe memory safety violations.
From a technical perspective, the core issue lies in how the library handles size calculations derived from user-supplied data without adequate bounds checking prior to allocation or copy operations. By declaring an undersized packet length that triggers an underflow, the resulting calculated offset or limit becomes erroneously large due to wrap-around behavior typical of unsigned integer arithmetic. This miscalculation allows subsequent memory access routines to operate outside the intended buffer limits. Consequently, this can result in out-of-bounds reads or writes, depending on how the library utilizes these flawed size parameters during stream parsing and data extraction processes.
The operational impact of this vulnerability is significant, primarily manifesting as a denial of service condition through application crashes. When an attacker supplies a specially crafted MPEG file to trigger this flaw, the smpeg-based application may encounter reachable assertions or segfaults caused by invalid memory access patterns. While the primary observed effect in many implementations involves crashing the host process via assertion failures or segmentation faults, out-of-bounds copy operations inherently carry risks of information disclosure if sensitive data is read from adjacent memory regions, or potentially code execution if write operations overwrite critical control flow structures such as return addresses or function pointers. This makes the vulnerability particularly dangerous in contexts where smpeg processes untrusted media files provided by external users or downloaded sources.
This flaw aligns with Common Weakness Enumeration category CWE-190, which covers integer overflow or wraparound errors that lead to subsequent memory corruption issues. Furthermore, from a tactical standpoint related to cyber attack frameworks like MITRE ATT&CK, this vulnerability facilitates initial access and execution phases by allowing adversaries to crash target systems running media processing software, potentially serving as a vector for further exploitation if combined with other vulnerabilities in the same application stack or environment.
To mitigate these risks, developers should immediately update smpeg to version 2.0.1 or later where such integer underflow checks have been addressed. For applications unable to upgrade promptly, implementing strict input validation on all MPEG stream headers before processing is essential. This includes verifying that packet sizes are within expected bounds and ensuring that arithmetic operations involving these values do not result in negative numbers or unexpectedly large positive integers due to wraparound effects. Additionally, employing fuzzing techniques during development can help identify similar parsing flaws across other multimedia libraries used in the software supply chain.