CVE-2026-22554

{**Short-term mitigation** until patched builds are available: 1. **Sandbox all mediainfo invocations** using seccomp-bpf to block `mprotect(PROT_EXEC)`: ```bash seccomp-tools dump mediainfo --analyze suspicious.mkv # Deny PROT_WRITE|PROT_EXEC transitions ``` 2. **Containerize processing** with minimal capabilities: ```yaml securityContext: allowPrivilegeEscalation: false capabilities: drop: [ALL] readOnlyRootFilesystem: true ``` 3. **Validate media before analysis** using a lightweight header parser to reject malformed channel counts. **Rollback**: Remove seccomp profile once vendor patches are applied and validated. Test legitimate multi-channel files (5.1, 7.1 surround) post-mitigation to ensure no false positives.}