CVE-2026-90783

MKVToolNix through version 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser, caused by integer wraparound in 32-bit arithmetic when computing an entry count. An attacker crafts a malicious AVI file with oversized index entry counts, which drives an undersized heap allocation that is subsequently overflowed when mkvmerge parses the file. Successful exploitation requires a victim to open or process the attacker-supplied AVI file, consistent with the local attack vector and user-interaction requirement in the CVSS 4.0 score (8.5, high), and can yield high impacts to confidentiality, integrity, and availability, such as application crashes or potential code execution under the user's privileges. Anyone running mkvmerge or the MKVToolNix GUI on versions through 101.0 to process untrusted AVI files is affected. No public proof of concept is known and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

What to do: Upgrade MKVToolNix to a release newer than 101.0 as soon as a fixed version is available from your distribution or upstream. Until patched, avoid using mkvmerge or the MKVToolNix GUI to open AVI files from untrusted or unknown sources, and scan suspicious media files in an isolated environment first. Defenders should watch for crashes or anomalous behavior in automated media-processing pipelines that ingest user-supplied AVI files.