漏洞概述 漏洞名称: MediaArea MediaInfoLib LXF parsing heap-based buffer overflow vulnerability CVE编号: CVE-2026-25104 发布日期: 2026年5月25日 CVSS评分: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) 漏洞类型: CWE-191 - Integer Underflow (Wrap or Wraparound) 描述: MediaInfoLib是一个用于显示视频和音频文件技术信息和元数据的库。在处理LXF格式文件时，存在一个堆缓冲区溢出漏洞。攻击者可以通过提供恶意文件触发此漏洞，导致任意代码执行。 影响范围 受影响版本: MediaInfoLib (version(s): 26.01) 产品URL: MediaInfoLib GitHub 修复方案 时间线: 2026-03-25: 初始厂商联系 2026-03-25: 漏洞披露 2026-05-12: 厂商补丁发布 2026-05-26: 公开报告 POC代码 ```cpp size_t Minimum(step-1); for (size_t Pos=0; PosChannels.size(); Pos++) if (MinimumChannels[Pos]->Buffer_Offset) Minimum=Common->Channels[Pos]->Buffer_Offset; MinimumBuffer_Offset; while (Minimum>=BitDepth) switch (BitDepth) { case 20: case 24: case 32: for (size_t Pos=0; PosChannels.size(); Pos++) { int8u Channel1=Common->Channels[Pos]->Buffer+Common->Channels[Pos]->Buffer_Offset; int8u Channel2=Common->Channels[Pos+1]->Buffer+Common->Channels[Pos+1]->Buffer_Offset; // Copy bytes from both channels to the merged channel Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+0]=Channel1[0]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+1]=Channel1[1]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+2]=Channel1[2]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+3]=Channel1[3]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+4]=Channel1[4]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+5]=Channel1[5]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+6]=Channel1[6]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+7]=Channel1[7]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+8]=Channel1[8]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+9]=Channel1[9]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+10]=Channel1[10]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+11]=Channel1[11]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+12]=Channel1[12]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+13]=Channel1[13]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+14]=Channel1[14]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+15]=Channel1[15]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+16]=Channel1[16]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+17]=Channel1[17]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+18]=Channel1[18]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+19]=Channel1[19]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+20]=Channel1[20]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+21]=Channel1[21]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+22]=Channel1[22]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+23]=Channel1[23]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+24]=Channel1[24]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+25]=Channel1[25]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+26]=Channel1[26]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+27]=Channel1[27]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+28]=Channel1[28]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+29]=Channel1[29]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+30]=Channel1[30]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+31]=Channel1[31]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+32]=Channel1[32]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+33]=Channel1[33]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+34]=Channel1[34]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+35]=Channel1[35]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+36]=Channel1[36]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+37]=Channel1[37]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+38]=Channel1[38]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+39]=Channel1[39]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+40]=Channel1[40]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+41]=Channel1[41]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+42]=Channel1[42]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+43]=Channel1[43]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+44]=Channel1[44]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+45]=Channel1[45]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+46]=Channel1[46]; Common->MergedChannel->Buffer[Common->MergedChannel->Buffer_Size+47]=Channel1[47]; Common->MergedChan