CVE-2026-90783 in MKVToolNix
Summary
by MITRE • 09/13/2026
MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer overflow when the file is parsed with mkvmerge.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified within MKVToolNix versions up to and including 101.0 represents a critical security flaw rooted in improper handling of integer arithmetic during the parsing of AVI container files. Specifically, the defect resides in the ODML superindex parser component of the bundled avilib library. This module is responsible for processing index data that allows random access within video streams, but it fails to adequately validate numerical values before performing memory allocation operations. The core technical issue involves an integer wraparound condition occurring during 32-bit arithmetic calculations. When a malicious AVI file contains oversized entry counts in its ODML superindex structure, the parser performs mathematical operations on these untrusted inputs without sufficient bounds checking or overflow detection mechanisms.
This lack of validation leads to a significant discrepancy between the calculated size required for memory allocation and the actual amount allocated by the system. Because the integer wraparound causes the computed value to be significantly smaller than intended, the application allocates an undersized heap buffer. Subsequently, when the parser proceeds to populate this buffer with data extracted from the malicious file, it writes beyond the boundaries of the allocated memory space. This results in a heap buffer overflow, where sensitive data or executable code can overwrite adjacent memory structures on the heap. Such overwrites can corrupt internal application state variables, leading to unpredictable behavior, crashes, and potentially arbitrary code execution if an attacker carefully crafts the payload to exploit specific heap layout conditions.
From an operational perspective, this vulnerability poses a severe risk to users who process untrusted or semi-trusted media files using mkvmerge, the primary tool in the MKVToolNix suite for merging and manipulating multimedia containers. An adversary can distribute a specially crafted AVI file through various vectors such as email attachments, malicious websites hosting downloadable content, or compromised storage devices. When a victim opens this file with the vulnerable version of MKVToolNix, the application will attempt to parse the ODML superindex data, triggering the integer wraparound and subsequent heap overflow. The impact ranges from denial of service due to application crashes to potential remote code execution if the attacker can control the content written into the overwritten memory regions. This aligns with CWE-190, which classifies errors resulting in integer overflow or wraparound, and CWE-787, which addresses out-of-bounds writes on heap structures.
To mitigate this risk, users are strongly advised to upgrade MKVToolNix to a version newer than 101.0 where the underlying avilib library has been patched to include proper validation for integer values before memory allocation. Developers integrating similar parsing logic should implement strict input sanitization and utilize safe arithmetic functions that detect overflow conditions prior to performing calculations involving user-supplied data. Furthermore, employing heap hardening techniques such as address space layout randomization can reduce the likelihood of successful exploitation by making it more difficult for attackers to predict memory layouts. Security teams monitoring internal environments should ensure that automated media processing pipelines are updated and configured to reject malformed container files at ingestion points rather than relying solely on application-level defenses during parsing operations.