CVE-2026-90783: MKVToolNix Heap Buffer Overflow Vulnerability

CVE-2026-90783 Overview

CVE-2026-90783 is a heap buffer overflow in MKVToolNix through version 101.0. The flaw resides in the bundled avilib library's Open Document Markup Language (ODML) superindex parser. An integer wraparound in 32-bit arithmetic causes an undersized heap allocation when parsing a crafted AVI file. When mkvmerge processes the malicious file, subsequent writes exceed the allocated buffer, corrupting adjacent heap memory. The weakness is classified under [CWE-680] (Integer Overflow to Buffer Overflow). Exploitation requires a local user to open or process an attacker-supplied AVI file, making phishing and supply-chain delivery of malicious media files viable attack paths.

Critical Impact
A crafted AVI file processed by mkvmerge triggers a heap buffer overflow that can lead to arbitrary code execution in the context of the user running MKVToolNix.

Affected Products

MKVToolNix versions up to and including 101.0
Bundled avilib-0.6.10 library shipped with MKVToolNix
mkvmerge command-line and GUI tooling that invokes the AVI parser

Discovery Timeline

2026-09-13 - CVE-2026-90783 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90783

Vulnerability Analysis

The vulnerability lives in the AVI ODML superindex parsing routine of the avilib component bundled with MKVToolNix. AVI files use ODML superindexes to describe large stream indexes, and each superindex declares an entry count. The parser multiplies the attacker-controlled entry count by the size of an entry structure using 32-bit arithmetic. When the product exceeds the range of a 32-bit unsigned integer, the value wraps around to a small number. The parser then allocates a heap buffer sized by this truncated value. Subsequent loops populate the buffer using the original, untruncated entry count, writing far beyond the allocation. The result is deterministic heap corruption controlled by fields in the malicious AVI header. Because mkvmerge runs in the security context of the invoking user, successful exploitation can lead to arbitrary code execution, data tampering, and process crashes.

Root Cause

The defect is a classic integer-overflow-to-buffer-overflow condition. The allocation-size calculation performs count * sizeof(entry) in 32-bit arithmetic without validating that the product fits within the target type. The relevant logic is visible in the AVILib source between lines 2552 and 2570. The upstream fix in commit 1495126138 introduces overflow-safe arithmetic and bounds validation before allocation.

Attack Vector

Exploitation requires local file processing with user interaction. An attacker delivers a crafted .avi file through email, chat, download, or a media-processing pipeline. When a user or automated workflow feeds the file to mkvmerge, the parser triggers the overflow. Server-side transcoding services that accept user-uploaded AVI files inherit the same risk under the account running the conversion job.

No verified proof-of-concept code has been published. Refer to the VulnCheck advisory for authoritative technical details.

Detection Methods for CVE-2026-90783

Indicators of Compromise

Unexpected crashes, segmentation faults, or abort signals from mkvmerge or MKVToolNix GUI processes when opening AVI files.
AVI files containing ODML indx chunks with abnormally large nEntriesInUse values inconsistent with file size.
Heap corruption traces or ASan reports referencing avilib.c around the superindex parsing routine.

Detection Strategies

Inventory endpoints and build servers running MKVToolNix <= 101.0 using software asset management or endpoint telemetry.
Alert on mkvmerge process terminations with non-zero exit codes correlated with AVI file inputs.
Sandbox-scan inbound AVI attachments and parse ODML index headers to flag values that would overflow 32-bit multiplication.

Monitoring Recommendations

Monitor child processes spawned by mkvmerge and mkvtoolnix-gui, treating any shell or interpreter execution as suspicious.
Log command-line invocations of mkvmerge on servers and transcoding hosts to detect anomalous file paths or extensions.
Enable crash reporting and forward core dumps referencing avilib symbols to incident response for analysis.

How to Mitigate CVE-2026-90783

Immediate Actions Required

Upgrade MKVToolNix to a release that includes commit 1495126138 fixing the ODML superindex arithmetic.
Restrict mkvmerge execution on servers to least-privilege service accounts without interactive login rights.
Block or quarantine AVI files from untrusted sources at the mail gateway and web proxy until patched builds are deployed.

Patch Information

The upstream project addressed the issue in the MKVToolNix repository hosted at Codeberg. Users should install a build newer than 101.0 that incorporates the fix commit. Linux distributions and third-party packagers should rebuild MKVToolNix and any tools that statically link the bundled avilib-0.6.10.

Workarounds

Avoid processing AVI files with mkvmerge until the patched version is installed; convert to MKV or MP4 with a different tool where possible.
Run mkvmerge inside a sandbox, container, or restricted user account with no access to sensitive files or credentials.
Disable automated media-processing pipelines that ingest AVI files from external sources until upgrades complete.

bash

# Verify installed MKVToolNix version and upgrade
mkvmerge --version

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade mkvtoolnix

# Fedora
sudo dnf upgrade mkvtoolnix

# Confirm fixed version is greater than 101.0
mkvmerge --version | head -n 1