Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

MediaInfo / MediaInfoLib bug bounty programs

mediaarea.net Updated

MediaInfo / MediaInfoLib runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
11
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program MediaInfo / MediaInfoLib runs.

  • MediaInfo / MediaInfoLib

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

11 targets. 5 excluded.

  • https://mediaarea.net/en/MediaInfo

    Web

  • Channel layout and channel-splitting logic, plus the duration, bitrate and frame-rate maths derived from parsed fields

    Products and areas

  • Codec header parsing for video and audio, where MediaInfo reads enough of a bitstream to describe it without decoding it

    Products and areas

  • MediaArea publishes no written security policy. GitHub private vulnerability reporting is enabled on MediaArea/MediaInfoLib and that is the path, and nothing narrows scope below the library and the tools built on it

    Products and areas

  • Subtitle and timed-text track handling, and the reference and playlist formats that point MediaInfo at further files

    Products and areas

  • Tag and metadata parsing: ID3v1 and ID3v2, APE tags, Vorbis comments, XMP and the container-native metadata boxes

    Products and areas

  • The broadcast and professional formats, covering MXF, LXF, GXF and the other house formats that get parsed far more often than they get audited

    Products and areas

  • The command-line tool and the desktop GUI, including how each handles a file it cannot make sense of

    Products and areas

  • The container readers in full: MP4 and ISOBMFF, Matroska, MPEG-2 transport and program streams, AVI, WAV and AIFF, Ogg and Flash Video

    Products and areas

  • The output serialisers for text, XML, JSON and the EBUCore and PBCore profiles

    Products and areas

  • The public library API and its bindings, covering the C and C++ interfaces and the .NET, Python and Java wrappers other systems drive it through

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Distribution packaging and Homebrew or distro builds rather than upstream

  • Incorrect or missing metadata output with no memory-safety or disclosure consequence

  • The mediaarea.net website and the download infrastructure, which are not this codebase

  • The project publishes no exclusion list. The items below are genuine boundaries rather than policy text

  • Third-party libraries MediaInfoLib links against rather than its own parsing code

Recent changes

Reward and scope changes across every MediaInfo / MediaInfoLib program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in MediaInfo / MediaInfoLib products, from the NVD.

Search NVD
  • CVE-2026-25713 High

    A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted media file that contains ID3v2 tags can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

  • CVE-2026-25104 High

    A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

  • CVE-2026-28764 High

    A heap-based buffer overflow vulnerability exists in the LXF element parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

  • CVE-2026-22554 High

    A heap-based buffer overflow vulnerability exists in the Channel Splitting functionality of MediaInfoLib (version(s): 26.01). A specially crafted .riff file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

  • CVE-2020-36646 Low

    A vulnerability classified as problematic has been found in MediaArea ZenLib up to 0.4.38. This affects the function Ztring::Date_From_Seconds_1970_Local of the file Source/ZenLib/Ztring.cpp. The manipulation of the argument Value leads to unchecked return value to null pointer dereference. Upgrading to version 0.4.39 is able to address this issue. The identifier of the patch is 6475fcccd37c9cf17e

  • CVE-2020-26797 High

    Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping.

  • CVE-2020-15395 High

    In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).

  • CVE-2019-11373 Medium

    An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.

About this page

This page gathers every public program listed under mediaarea.net: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.