Loading story…
Cisco Talos disclosed four heap-based buffer overflow vulnerabilities in the MediaArea MediaInfoLib library affecting version 26.01. The flaws, tracked as CVE-2026-25104, CVE-2026-25713, CVE-2026-28764, and CVE-2026-22554, were discovered by Dimitrios Tatsis and mapped by Talos to TALOS-2026-2367, TALOS-2026-2368, TALOS-2026-2371, and TALOS-2026-2374.
Talos said the vulnerabilities can be triggered when an attacker supplies a specially crafted media file, potentially leading to arbitrary code execution in affected environments. MediaArea has patched the issues under Cisco’s third-party vulnerability disclosure process, and Talos said updated Snort rule sets are available to help defenders detect exploitation attempts targeting the library.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The vendor patched the four MediaInfoLib vulnerabilities under Cisco's third-party vulnerability disclosure policy. Talos also said Snort coverage is available to help detect exploitation attempts.
Cisco Talos disclosed four heap-based buffer overflow vulnerabilities affecting MediaArea MediaInfoLib version 26.01. The flaws, discovered by Dimitrios Tatsis, can be triggered with a malicious media file and may lead to arbitrary code execution.
Cisco Talos publicly released details of a heap-based buffer overflow in MediaInfoLib 26.01's Channel Splitting functionality when parsing specially crafted RIFF audio files. Talos said the flaw, originally reported to the vendor on 2026-03-25 and patched on 2026-05-12, could lead to out-of-bounds heap writes and possible arbitrary code execution.
MediaArea released a patch for the MediaInfoLib 26.01 heap-based buffer overflow in LXF element parsing that Talos had previously reported. The flaw could be triggered with a crafted .lxf file and may lead to arbitrary code execution.
Cisco Talos contacted MediaArea on 2026-03-25 to disclose a heap-based buffer overflow vulnerability in MediaInfoLib 26.01's LXF parsing functionality. The issue could be triggered with a crafted .lxf file and may lead to arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceblog.talosintelligence.com
Open sourcetalosintelligence.com
Open sourcetalosintelligence.com
Open sourcetalosintelligence.com
Open sourcetalosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2026-33848** and **CVE-2026-33849**, were disclosed in **LinkingVision rapidvms**, both classified as **CWE-119** improper restriction of operations within the bounds of a memory buffer. The flaws affect **rapidvms versions before `PR#96`** and carry the same **CVSS v3.1** vector, `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating network-reachable exploitation with low attack complexity, no required privileges, user interaction, and potential for high impact across confidentiality, integrity, and availability. Both CVE records point to **GitHub pull request `#96`** in the `linkingvision/rapidvms` repository as the referenced fix or related remediation. Organizations running vulnerable rapidvms builds should review the changes in that pull request, identify any exposed instances, and prioritize upgrading or patching affected systems because successful exploitation could lead to severe compromise of the video management platform.
Jun 29, 2026
Two high-severity vulnerabilities, `CVE-2018-25265` and `CVE-2018-25268`, were documented for **LanSpy 2.0.1.159**, affecting the application's scan functionality and exposing users to local buffer overflow attacks. The flaws were classified as `CWE-787` and can let an attacker trigger memory corruption by supplying oversized input in the scan section or scan field, causing application crashes and creating a path to arbitrary code execution. The published details indicate that `CVE-2018-25265` can be exploited through structured exception handling (SEH), including egghunter-based shellcode discovery and controlled jumps, while `CVE-2018-25268` allows instruction pointer overwrite with a payload consisting of 688 bytes of padding followed by 4 bytes of attacker-controlled data. Both entries were assigned high-impact CVSS v3.1 and CVSS v4.0 severity metrics, and the records reference material from **LizardSystems**, **Exploit-DB**, and **VulnCheck**.
Jun 29, 2026
Microsoft published security updates for a cluster of **Windows Digital Media** and **Windows Media** elevation-of-privilege vulnerabilities, including `CVE-2025-21226`, `CVE-2025-21228`, `CVE-2025-21229`, `CVE-2025-21255`, `CVE-2025-21256`, `CVE-2025-21260`, `CVE-2025-21265`, `CVE-2025-21324`, `CVE-2025-21327`, and `CVE-2025-32716`. The issues were listed in Microsoft’s Security Update Guide as local privilege escalation bugs affecting Windows media-related components. The bulk of the advisories identify **Windows Digital Media Elevation of Privilege Vulnerability** entries, while `CVE-2025-32716` is tracked as a **Windows Media Elevation of Privilege Vulnerability**, indicating a broader set of media-handling components were affected. Microsoft provided update-guide entries for each CVE, signaling that organizations should prioritize applying the relevant Windows security updates to reduce the risk of attackers gaining elevated privileges on vulnerable systems.
Jul 2, 2026