diff --git a/Source/MediaInfo/Video/File_Mpeg4v.cpp b/Source/MediaInfo/Video/File_Mpeg4v.cpp
index 224a24e3fd..b7d789ad30 100644
--- a/Source/MediaInfo/Video/File_Mpeg4v.cpp
+++ b/Source/MediaInfo/Video/File_Mpeg4v.cpp
@@ -418,7 +418,10 @@ void File_Mpeg4v::Streams_Fill()
         Fill(Stream_Video, 0, Video_Codec_Profile, Mpeg4v_Profile_Level(profile_and_level_indication));
     }
 
-    if (frame_rate_code!=(int8u)-1)
+    // frame_rate_code is bitstream-controlled; the existing (int8u)-1 sentinel guard
+    // catches only 0xFF, so a crafted MPEG-4 Visual bitstream can index past the
+    // 16-entry Mpegv_frame_rate table -- see gh#2608.
+    if (frame_rate_code!=(int8u)-1 && frame_rate_code<sizeof(Mpegv_frame_rate)/sizeof(*Mpegv_frame_rate))
         Fill(Stream_Video, StreamPos_Last, Video_FrameRate, Mpegv_frame_rate[frame_rate_code]);
     if (bit_rate!=(int32u)-1)
         Fill(Stream_Video, StreamPos_Last, Video_BitRate_Nominal, bit_rate*400);
diff --git a/Source/MediaInfo/Video/File_Mpegv.cpp b/Source/MediaInfo/Video/File_Mpegv.cpp
index 2c3d0c8542..d6c9fd76a6 100644
--- a/Source/MediaInfo/Video/File_Mpegv.cpp
+++ b/Source/MediaInfo/Video/File_Mpegv.cpp
@@ -1274,8 +1274,13 @@ void File_Mpegv::Streams_Fill()
 
     Fill(Stream_Video, 0, Video_Width, 0x1000*horizontal_size_extension+horizontal_size_value);
     Fill(Stream_Video, 0, Video_Height, 0x1000*vertical_size_extension+vertical_size_value);
-    Fill(Stream_Video, 0, Video_ChromaSubsampling, Mpegv_chroma_format[chroma_format]);
-    Fill(Stream_Video, 0, Video_ColorSpace, Mpegv_chroma_format_Colorspace[chroma_format]);
+    // chroma_format is bitstream-controlled; a crafted MPEG video can pass an 8-bit
+    // value well past the 4-entry tables. Guard both accesses -- see gh#2612.
+    if (chroma_format<sizeof(Mpegv_chroma_format)/sizeof(*Mpegv_chroma_format))
+    {
+        Fill(Stream_Video, 0, Video_ChromaSubsampling, Mpegv_chroma_format[chroma_format]);
+        Fill(Stream_Video, 0, Video_ColorSpace, Mpegv_chroma_format_Colorspace[chroma_format]);
+    }
     Fill(Stream_Video, 0, Video_BitDepth, 8);
 
     //AspectRatio
@@ -1287,21 +1292,27 @@ void File_Mpegv::Streams_Fill()
             Fill(Stream_Video, 0, Video_PixelAspectRatio, 1.000, 3, true);
         else if (display_horizontal_size && display_vertical_size)
         {
-            if (vertical_size_value && Mpegv_aspect_ratio2[aspect_ratio_information])
+            if (aspect_ratio_information<sizeof(Mpegv_aspect_ratio2)/sizeof(*Mpegv_aspect_ratio2)
+             && vertical_size_value && Mpegv_aspect_ratio2[aspect_ratio_information])
                 Fill(Stream_Video, StreamPos_Last, Video_DisplayAspectRatio, (float)(0x1000*horizontal_size_extension+horizontal_size_value)/(0x1000*vertical_size_extension+vertical_size_value)
                                                                              *Mpegv_aspect_ratio2[aspect_ratio_information]/((float)display_horizontal_size/display_vertical_size), 3, true);
         }
-        else if (Mpegv_aspect_ratio2[aspect_ratio_information])
+        else if (aspect_ratio_information<sizeof(Mpegv_aspect_ratio2)/sizeof(*Mpegv_aspect_ratio2)
+              && Mpegv_aspect_ratio2[aspect_ratio_information])
             Fill(Stream_Video, StreamPos_Last, Video_DisplayAspectRatio, Mpegv_aspect_ratio2[aspect_ratio_information], 3, true);
     }
     else //Version 1
     {
-        if (vertical_size_value && Mpegv_aspect_ratio1[aspect_ratio_information])
+        if (aspect_ratio_information<sizeof(Mpegv_aspect_ratio1)/sizeof(*Mpegv_aspect_ratio1)
+         && vertical_size_value && Mpegv_aspect_ratio1[aspect_ratio_information])
             Fill(Stream_Video, StreamPos_Last, Video_DisplayAspectRatio, (float)(0x1000*horizontal_size_extension+horizontal_size_value)/(0x1000*vertical_size_extension+vertical_size_value)/Mpegv_aspect_ratio1[aspect_ratio_information], 3, true);
     }
 
     //FrameRate
-    if (Mpegv_frame_rate[frame_rate_code])
+    // aspect_ratio_information and frame_rate_code are bitstream-controlled -- same class
+    // of guard as chroma_format above (gh#2612).
+    if (frame_rate_code<sizeof(Mpegv_frame_rate)/sizeof(*Mpegv_frame_rate)
+     && Mpegv_frame_rate[frame_rate_code])
         Fill(Stream_Video, StreamPos_Last, Video_FrameRate, Mpegv_frame_rate[frame_rate_code] * (frame_rate_extension_n + 1) / (frame_rate_extension_d + 1));
 
     //BitRate
@@ -1373,7 +1384,12 @@ void File_Mpegv::Streams_Fill()
     }
 
     //Profile
-    if (!profile_and_level_indication_escape && profile_and_level_indication_profile!=(int8u)-1 && profile_and_level_indication_level!=(int8u)-1)
+    // profile_and_level_indication_profile / _level are bitstream-controlled; the
+    // existing (int8u)-1 guards only catch 0xFF, so a crafted stream can index past
+    // Mpegv_profile_and_level_indication_profile/_level (both char *[16]).
+    if (!profile_and_level_indication_escape
+     && profile_and_level_indication_profile<sizeof(Mpegv_profile_and_level_indication_profile)/sizeof(*Mpegv_profile_and_level_indication_profile)
+     && profile_and_level_indication_level<sizeof(Mpegv_profile_and_level_indication_level)/sizeof(*Mpegv_profile_and_level_indication_level))
     {
         Fill(Stream_Video, 0, Video_Format_Profile, Ztring().From_UTF8(Mpegv_profile_and_level_indication_profile[profile_and_level_indication_profile])+__T("@")+Ztring().From_UTF8(Mpegv_profile_and_level_indication_level[profile_and_level_indication_level]));
         Fill(Stream_Video, 0, Video_Codec_Profile, Ztring().From_UTF8(Mpegv_profile_and_level_indication_profile[profile_and_level_indication_profile])+__T("@")+Ztring().From_UTF8(Mpegv_profile_and_level_indication_level[profile_and_level_indication_level]));
diff --git a/Source/MediaInfo/Video/File_Vc1.cpp b/Source/MediaInfo/Video/File_Vc1.cpp
index 271bba2917..d59840ba61 100644
--- a/Source/MediaInfo/Video/File_Vc1.cpp
+++ b/Source/MediaInfo/Video/File_Vc1.cpp
@@ -274,8 +274,13 @@ void File_Vc1::Streams_Accept()
 void File_Vc1::Streams_Fill()
 {
     //Calculating - PixelAspectRatio
+    // AspectRatio, profile and colordiff_format come straight from the bitstream;
+    // 0x0F is the 'custom AR' escape and (int8u)-1 the 'unset' sentinel, but a crafted
+    // VC-1 stream can supply any 8-bit value up to 0xFE and slip past both guards into
+    // Vc1_PixelAspectRatio[16] / Vc1_Profile[4] / Vc1_ChromaSubsamplingFormat[4] --
+    // see gh#2611.
     float32 PixelAspectRatio;
-    if (AspectRatio!=0x0F)
+    if (AspectRatio!=0x0F && AspectRatio<sizeof(Vc1_PixelAspectRatio)/sizeof(*Vc1_PixelAspectRatio))
         PixelAspectRatio=Vc1_PixelAspectRatio[AspectRatio];
     else if (AspectRatioY)
         PixelAspectRatio=((float)AspectRatioX)/((float)AspectRatioY);
@@ -283,14 +288,15 @@ void File_Vc1::Streams_Fill()
         PixelAspectRatio=1; //Unknown
 
     Ztring Profile;
-    if (profile!=(int8u)-1)
+    if (profile!=(int8u)-1 && profile<sizeof(Vc1_Profile)/sizeof(*Vc1_Profile))
         Profile=Vc1_Profile[profile];
     if (profile==3 && level!=(int8u)-1)
         Profile+=__T("@L")+Ztring::ToZtring(level);
     Fill(Stream_Video, 0, Video_Format_Profile, Profile);
     Fill(Stream_Video, 0, Video_Codec_Profile, Profile);
     Fill(Stream_Video, 0, Video_ColorSpace, "YUV");
-    Fill(Stream_Video, 0, Video_ChromaSubsampling, Vc1_ChromaSubsamplingFormat[colordiff_format]);
+    if (colordiff_format<sizeof(Vc1_ChromaSubsamplingFormat)/sizeof(*Vc1_ChromaSubsamplingFormat))
+        Fill(Stream_Video, 0, Video_ChromaSubsampling, Vc1_ChromaSubsamplingFormat[colordiff_format]);
     if (coded_width && coded_height)
     {
         Fill(Stream_Video, StreamPos_Last, Video_Width, (coded_width+1)*2);