Heap Buffer Overflow in MKVToolNix avilib Library

MKVToolNix versions through 101.0 contain a critical heap buffer overflow vulnerability in the bundled avilib library. The flaw exists within the ODML superindex parser and is triggered by an integer wraparound during 32-bit arithmetic operations. An attacker can exploit this by distributing a specially crafted AVI file containing malicious entry counts. When a user parses this file using the mkvmerge utility, the application performs an undersized heap allocation. Subsequent operations then write data outside the bounds of this allocation, leading to a heap buffer overflow. This condition could allow an attacker to achieve arbitrary code execution or cause an application crash. Defenders should prioritize updating MKVToolNix to a version beyond 101.0 where the avilib library has been patched.

Impact

Successful exploitation of this vulnerability could lead to arbitrary code execution on systems where users interact with maliciously crafted AVI files via the mkvmerge command-line utility or the MKVToolNix GUI. This affects all platforms running the vulnerable versions of the software, including Windows, Linux, and macOS.

Recommendation

• Upgrade MKVToolNix to the latest version, which contains the fix for the avilib library and CVE-2026-90783.
• Audit file ingestion workflows that utilize mkvmerge for automated media processing to ensure they only process trusted files.
• Monitor for unexpected crashes of the mkvmerge process, which may indicate attempted exploitation of heap-based vulnerabilities.