MediaArea MediaInfoLib Heap-Based Buffer Overflow Vulnerability in LXF Parsing

A heap-based buffer overflow vulnerability has been identified in MediaArea MediaInfoLib version 26.01, specifically within the LXF file parsing functionality. This vulnerability allows for arbitrary code execution. The issue arises when the software processes a specially crafted .lxf file, merging audio channels in a way that can overwrite memory and potentially lead to exploitation.

Impact

Exploitation of this vulnerability can result in arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using a crafted .lxf file that exploits the audio channel merging process in MediaInfoLib. This can be done by manipulating the file's audio data to create an underflow condition that the parser does not properly handle, causing a heap buffer overflow.

Remediation

Users are advised to update to the patched version of MediaInfoLib, which is available on the MediaArea GitHub repository.