CVE-2026-112283

MediumCVSS 5.5

Published: 19/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.

Risk Assessment

Crafted media files can hang or crash playback applications (e.g., VLC), resulting in denial of service.

Recommendation

Upgrade libbluray beyond 1.5.1 and avoid playing untrusted Blu-ray images/files until the fix is deployed.

Other vulnerabilities in libbluray

CVE-2026-112282Medium
VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num_ep_fine set to zero and an unclamped ref_ep_fine_id, triggering reads during seeking for denial of service.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS