CVE-2026-112281
Received Received - Intake

libaribb24 Stack-Based Buffer Overflow in decoder_handle_csi

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112281
EUVD
EUVD-2026-104292

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nkoriyama aribb24 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libaribb24 through version 1.0.3 has a stack-based buffer overflow in the decoder_handle_csi() function. Attackers can exploit this by providing more than 256 parameter bytes in a CSI introducer within a caption statement. This allows writing past a fixed 256-entry array, potentially crashing applications like FFmpeg or VLC or corrupting the return address.

Detection Guidance

Detecting this vulnerability requires checking for outdated versions of libaribb24 (aribb24) through 1.0.3. Inspect installed packages using commands like 'dpkg -l | grep aribb24' on Debian-based systems or 'rpm -qa | grep aribb24' on RPM-based systems. For source installations, check the version in the build directory or via 'aribb24 --version' if supported.

Impact Analysis

This vulnerability could allow attackers to crash media players or applications using libaribb24, such as FFmpeg or VLC, by providing specially crafted media files or broadcast streams. It may also enable arbitrary code execution in some cases, depending on the application's memory layout.

Compliance Impact

This vulnerability primarily affects media processing applications like FFmpeg or VLC by enabling crashes or potential arbitrary code execution through crafted media files or broadcast streams. It does not directly impact compliance with GDPR or HIPAA, as those standards focus on data protection, privacy, and security controls rather than media processing vulnerabilities.

Mitigation Strategies

Immediately update libaribb24 to a patched version beyond 1.0.3. If no patch is available, consider disabling or removing the library if it is not essential. For applications like FFmpeg or VLC, ensure you are using the latest versions that may include fixes for this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112281. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart