CVE-2026-112281
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.
Risk Assessment
A stack overflow can crash applications or potentially enable arbitrary code execution when processing untrusted media.
Recommendation
Upgrade libaribb24 beyond 1.0.3 and avoid processing untrusted media files or streams until the fix is deployed.
Other vulnerabilities in libaribb24
Original NVD description (English source)
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS