Log in Start free

Vulnerability · Published Sep 13, 2026 · Assigned by VulnCheck

CVE-2026-90783MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound

High 7.8

In plain English

A high-severity security flaw in MKVToolNix from Moritz Bunkus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 89.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer overflow when the file is parsed with mkvmerge.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24mkvtoolnix99.0-r1ALPINE-CVE-2026-90783
Debian:12mkvtoolnix74.0.0-1+deb12u1DEBIAN-CVE-2026-90783
Debian:13mkvtoolnix92.0-1+deb13u1DEBIAN-CVE-2026-90783
Debian:14mkvtoolnix101.0-2DEBIAN-CVE-2026-90783
Ubuntu:22.04:LTSmkvtoolnixno fix listedUBUNTU-CVE-2026-90783
Ubuntu:24.04:LTSmkvtoolnixno fix listedUBUNTU-CVE-2026-90783
Ubuntu:26.04:LTSmkvtoolnixno fix listedUBUNTU-CVE-2026-90783
Ubuntu:26.10mkvtoolnixno fix listedUBUNTU-CVE-2026-90783

Affected products (as reported)

VendorProductVersions
Moritz Bunkus MKVToolNix 0 – through 101.0

Weakness: CWE-680 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References