CVE-2026-112280

MediumCVSS 6.1

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, leading to heap memory corruption.

Risk Assessment

This can crash FFmpeg or VLC and possibly corrupt further memory, posing a risk of destabilizing systems that process untrusted media.

Recommendation

Update libaribb24 to a version later than 1.0.3 or apply the vendor patch. Avoid processing untrusted media files until updated.

Other vulnerabilities in libaribb24

CVE-2026-112281Medium
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.

Original NVD description (English source)

libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS