CVE-2026-112009 Details
Description
smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashes applications opening it through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data.
A heap out-of-bounds read vulnerability has been identified in the SDL MPEG Player Library (SMPEG) versions through 2.0.0. The issue arises in the MPEGsystem::FillBuffer() function, where the code improperly handles system header stream tables. This flaw allows attackers to read beyond the allocated 16,384-byte buffer by crafting an MPEG file with specific stream table bytes. The vulnerability can be exploited by applications using the SMPEG_new family of functions to open the manipulated MPEG files, leading to potential crashes or memory corruption.
Users can update to the latest version of SMPEG, where this vulnerability has been fixed. The specific commit addressing the issue is available on the project's GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| smpeg | <= 2.0.0 (semver) d188dc111f4817288718705e4a84e248803ccfdc |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |