A heap buffer overflow vulnerability in the MKVToolNix avilib library allows an attacker to achieve arbitrary code execution via a specially crafted AVI file.

This vulnerability is a heap buffer overflow (CWE-680) located in the avilib library's ODML superindex parser. An unauthenticated attacker can trigger this flaw by providing a maliciously crafted AVI file to the mkvmerge utility, which performs an undersized heap allocation due to integer wraparound.

The exploitation of this vulnerability can lead to memory corruption, potentially resulting in application crashes or the execution of arbitrary code within the context of the user running mkvmerge. Given the CVSS score of 7.8, this is a high-severity issue that poses a significant risk to workstations or servers that process untrusted media files, potentially leading to unauthorized system access or data compromise.

Immediate Action: Update MKVToolNix to a version containing the fix identified in commit 1495126138e086080f0163bee27fafbdf956a1d0, or ensure you are utilizing a version released after the patch was integrated.

Proactive Monitoring: Monitor systems for unexpected mkvmerge process crashes or anomalous memory usage when processing media files.

Compensating Controls: Restrict the processing of AVI files from untrusted sources and utilize sandboxing technologies to isolate media conversion tasks from sensitive environments.

Public Exploit Available: Unknown

Organizations should prioritize updating MKVToolNix installations to the latest patched version to eliminate the risk of heap-based memory corruption. Since the vulnerability is triggered during the parsing of media files, users should exercise caution when handling AVI files from unknown or unverified sources until updates are fully deployed across the environment.