Integer Underflow Vulnerability in SMPEG by Icculus
CVE-2026-112010

6.8MEDIUM

Key Information:

Vendor: Icculus
Status: Smpeg
Vendor: CVE Published:; 18 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-112010?

The vulnerability in SMPEG affects versions up to 2.0.0, allowing attackers to exploit an integer underflow in the stream_header() function. By declaring an undersized packet length, attackers can manipulate the packet_size, potentially leading to a crash of the application through an assertion failure or an out-of-bounds memory copy. This can be triggered by supplying a specially crafted MPEG file accessed via SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data functions.

Affected Version(s)

smpeg 0 <= 2.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-112010 - Proof of Concept