Stack Buffer Overflow Vulnerability in mpv Package
Summary
OSV-2026-728: Stack-buffer-overflow in autoload_external_files. Affects mpv versions >= 0cfd52074b50df623f9fa9fd9ad0ba4657311398, < 6bdacac99153b5a487d108e11d2f8d7678afd2fd. Fixed in 6bdacac99153b5a487d108e11d2f8d7678afd2fd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mpv is a versatile media player that supports a wide range of video and audio formats. It is known for its high-quality playback and extensive feature set, including support for various codecs, filters, and scripting capabilities. However, like many software applications, mpv is susceptible to vulnerabilities that can compromise its stability and security. This specific vulnerability relates to the autoload_external_files function, which is responsible for loading external files into the player.
Vulnerability Detail
The vulnerability identified is a stack-buffer overflow occurring in the autoload_external_files function of the mpv package. This issue was reported by OSS-Fuzz and can lead to a crash when the function attempts to read beyond the allocated memory buffer. The crash state indicates that the overflow occurs during the loading of external options in a worker thread, potentially allowing an attacker to exploit this flaw to execute arbitrary code or cause a denial of service. The vulnerability was introduced in commit 0cfd52074b50df623f9fa9fd9ad0ba4657311398 and has been fixed in commit 6bdacac99153b5a487d108e11d2f8d7678afd2fd.
How To Fix
Minimum fixed version
6bdacac99153b5a487d108e11d2f8d7678afd2fd
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the autoload_external_files function until the package is updated. This may involve manually loading files without relying on the automatic loading feature, thereby reducing the risk of encountering the vulnerability.
Conclusion
The stack-buffer overflow vulnerability in the mpv package poses a significant risk to users, potentially leading to crashes and exploitation. It is crucial to update to the patched version to ensure the security and stability of the application. Users can also utilize Vulert to monitor for vulnerabilities in their software in real-time.
See every vulnerability recorded for mpv →
FAQ
A stack-buffer overflow occurs when a program writes more data to a buffer located on the stack than it can hold, leading to memory corruption and potential exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json to Vulert's playground, you can check for vulnerabilities without needing to sign up.
Exploitation of this vulnerability could lead to application crashes, data corruption, or even remote code execution, depending on the attacker's capabilities.
Yes, you should upgrade to the version fixed in commit 6bdacac99153b5a487d108e11d2f8d7678afd2fd to mitigate this vulnerability.
If an immediate update is not possible, consider implementing the suggested workaround by avoiding the use of the autoload_external_files function until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for mpv.
