{"id":"CVE-2020-26797","aliases":["DEBIAN-CVE-2020-26797","DLA-2603-1","EUVD-2020-19333","GHSA-69fx-97mc-754f","UBUNTU-CVE-2020-26797","USN-5237-1"],"status":"published","title":"Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib:...","description":"Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02868,"percentile":0.86897,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2021-03-18T19:17:32Z","modified":"2026-10-26T12:01:06Z","fixes":[{"ecosystem":"Debian:12","package":"libmediainfo","fixed_in":["20.09+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libmediainfo","fixed_in":["20.09+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libmediainfo","fixed_in":["20.09+dfsg-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libmediainfo","fixed_in":["0.7.67-2ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmediainfo","fixed_in":["0.7.82-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmediainfo","fixed_in":["17.12-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmediainfo","fixed_in":["19.09+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.91-1+deb9u1"}]}],"versions":["0.7.91-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.67-2ubuntu1+esm2"}]}],"versions":["0.7.64-2","0.7.64-3","0.7.65-1","0.7.67-1","0.7.67-2","0.7.67-2ubuntu1","0.7.67-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.82-1ubuntu0.1~esm2"}]}],"versions":["0.7.73-1ubuntu1","0.7.80-1","0.7.81-1","0.7.82-1","0.7.82-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.12-1ubuntu0.1+esm1"}]}],"versions":["0.7.98-2","0.7.99-1","17.10-1","17.12-1","17.12-1build1","17.12-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.09+dfsg-2ubuntu0.1~esm1"}]}],"versions":["18.12-2","19.09+dfsg-1","19.09+dfsg-2","19.09+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.67-2ubuntu1+esm2"}]}],"versions":["0.7.64-2","0.7.64-3","0.7.65-1","0.7.67-1","0.7.67-2","0.7.67-2ubuntu1","0.7.67-2ubuntu1+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.82-1ubuntu0.1~esm2"}]}],"versions":["0.7.73-1ubuntu1","0.7.80-1","0.7.81-1","0.7.82-1","0.7.82-1ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.12-1ubuntu0.1+esm1"}]}],"versions":["0.7.98-2","0.7.99-1","17.10-1","17.12-1","17.12-1build1","17.12-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.09+dfsg-2ubuntu0.1~esm1"}]}],"versions":["18.12-2","19.09+dfsg-1","19.09+dfsg-2","19.09+dfsg-2build1"],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mediaarea","product":"mediainfo"}],"references":[{"url":"https://sourceforge.net/p/mediainfo/bugs/1154/","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYI2372RLWYQVLSYD5PBI4YTXNMVDZCZ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26797"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYI2372RLWYQVLSYD5PBI4YTXNMVDZCZ/"},{"url":"https://github.com/advisories/GHSA-69fx-97mc-754f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-26797","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-26797","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5237-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-26797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15395","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-26797","description":"Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping.","status":"published","published":"2021-03-18T19:17:32Z","modified":"2024-08-04T16:03:21.663Z","updated_at":"2026-11-02T14:35:46.129376Z"}],"euvd":[{"id":"EUVD-2020-19333","description":"Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping.","status":"published","published":"2021-03-18T19:17:32Z","modified":"2024-08-04T16:03:21Z","updated_at":"2026-11-03T03:07:14.653267Z"}],"ghsa":[{"id":"GHSA-69fx-97mc-754f","title":"Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib:...","description":"Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping.","status":"published","published":"2022-05-24T17:44:47Z","modified":"2023-01-29T05:05:42Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:45:51.307262Z"}],"nvd":[{"id":"CVE-2020-26797","description":"Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping.","status":"published","published":"2021-03-18T20:15:12.893Z","modified":"2026-06-17T03:08:21.123Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"CVE-2020-26797","description":"Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping.","status":"published","published":"2021-03-18T20:15:12.893Z","modified":"2026-10-24T10:31:03.954638338Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"DEBIAN-CVE-2020-26797","description":"Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping.","status":"published","published":"2021-03-18T20:15:12.893Z","modified":"2026-10-26T12:01:06.535409728Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"UBUNTU-CVE-2020-26797","description":"Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping.","status":"published","published":"2021-03-18T20:15:00Z","modified":"2026-04-22T12:35:55.145239Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"DLA-2603-1","title":"libmediainfo - security update","status":"published","published":"2021-03-22T00:00:00Z","modified":"2026-03-09T01:20:03.395123Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"USN-5237-1","title":"libmediainfo vulnerabilities","description":"It was discovered that MediaInfoLib incorrectly handled certain specially\ncrafted files. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2020-26797)\n\nIt was discovered that MediaInfoLib incorrectly handled certain specially\ncrafted MpegPs files. An attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04\nESM. (CVE-2020-15395)\n","status":"published","published":"2022-08-01T05:54:27Z","modified":"2026-06-29T13:49:35.385357816Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}