CVE-2026-112010 Details
Description
smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEG_new, SMPEG_new_rwops or SMPEG_new_data to trigger a reachable assertion or out-of-bounds copy, crashing the application.
A vulnerability allowing integer underflow has been identified in the SMPEG library, specifically in versions through 2.0.0. The issue arises in the 'stream_header()' function within 'MPEGsystem.cpp'. Attackers can exploit this vulnerability by declaring a packet length that is too small, causing the 'packet_size' variable to wrap around. This crafted MPEG file can be processed using the 'SMPEG_new', 'SMPEG_new_rwops', or 'SMPEG_new_data' functions. The underflowed packet size can lead to a crash by either triggering an assertion or causing an out-of-bounds memory copy.
Users can update to SMPEG version 2.0.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/icculus/smpeg | [email protected] | ProductSource CodeVendor |
| https://github.com/icculus/smpeg/blob/d188dc111f4817288718705e4a84e248803ccfdc/MPEGsystem.cpp#L295-L350 | [email protected] | Source CodeVendor |
| https://github.com/icculus/smpeg/blob/d188dc111f4817288718705e4a84e248803ccfdc/MPEGsystem.cpp#L777 | [email protected] | Source CodeVendor |
| https://hackmd.io/@haindpwn/smpeg-system-header-stream-table-oob-read | [email protected] | BundleExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/smpeg-through-2.0.0-integer-underflow-via-stream-header-in-mpegsystem-cpp | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| icculus smpeg | <= 2.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |