CVE-2026-112010 icculus CVE debrief

Who should care

Defenders responsible for applications that use the smpeg library should assess exposure and prioritize verification of the library version in use. They should also review compensating controls for exposed systems and monitor for potential crashes or unusual behavior. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-112010 is a MEDIUM-severity vulnerability in the smpeg library that can cause crashes and potentially lead to denial-of-service (DoS) attacks. Defenders responsible for applications that use this library should assess exposure and prioritize verification of the library version in use.

• crashing of applications that use the smpeg library
• potential for denial-of-service (DoS) attacks
• need for verification of smpeg library version and exposure in applications

Technical summary

The smpeg library contains an integer underflow vulnerability in the stream_header() function in MPEGsystem.cpp. This can cause a reachable assertion or out-of-bounds copy, crashing applications that use this library. Attackers can exploit this by supplying a crafted MPEG file opened via SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data. The vulnerability can lead to denial-of-service (DoS) attacks and application crashes. Defenders should prioritize verifying the smpeg library version and assessing exposure in applications that use this library.

Defensive priority

Defenders should prioritize verifying the smpeg library version and assessing exposure in applications that use this library.

Recommended defensive actions

• Verify the smpeg library version in use and update to a fixed version if available
• Assess exposure in applications that use the smpeg library
• Monitor for potential crashes or unusual behavior in applications that use the smpeg library
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but the scope of affected applications and versions is not explicitly stated. Further verification is needed to determine the extent of exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.