BSD Portsmkvtoolnix -- Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound
· CVE-2026-90783 · VuXML entry
Moritz Bunkus reports: potential heap overflows/invalid memory access in the ODML index handling due to unsiged integer multiplication wrapping around (colloquially known as "overflowing") with specifically crafted AVI files. Affects only mkvmerge as the other tools do not read AVIs
Affected versions
- mkvtoolnix < 102.0
By system
0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | multimedia/mkvtoolnix | 103.0 | fixed | |
| OpenBSD | multimedia/mkvtoolnix | 102.0 | out of range, by version |