Heap Buffer Overflow in MKVToolNix AVI Parser

CVE-2026-90783 is a heap buffer overflow vulnerability in MKVToolNix versions through 101.0, specifically within the bundled avilib library's ODML superindex parser. The flaw stems from integer wraparound in 32-bit arithmetic calculations that determine heap allocation sizes. When an attacker crafts a malicious AVI file with artificially inflated entry counts in the superindex structure, the parser miscalculates the required buffer size due to integer overflow, allocating a heap region smaller than needed. This undersized allocation is then overwritten during parsing, leading to classic heap buffer overflow conditions. MKVToolNix is widely used for video file manipulation and conversion, making this vulnerability relevant to content creators, media professionals, and anyone processing untrusted video files—particularly in automated workflows or server environments running mkvmerge without proper input validation.

While this CVE lacks direct MITRE ATT&CK mapping, Casky's Claude-powered analysis with extended reasoning would identify this as part of the "Exploitation of Remote Code Execution" attack pattern, correlating it with techniques like T1203 (Exploitation for Client Execution) and T1190 (Exploit Public-Facing Application). Practitioners using Casky would see detection signals centered on abnormal file parsing behavior: specifically, monitoring for mkvmerge processes that exhibit memory access violations, unexpected process termination with heap corruption signatures, or attempts to load and parse AVI files with malformed ODML structures containing extreme superindex entry counts. The platform's skill set would flag the integer arithmetic vulnerability pattern—a classic code weakness indicator—and recommend input sanitization checks, file format validation before processing, and runtime protections like AddressSanitizer or heap canaries to catch overflow attempts before exploitation.