Heap Out-of-Bounds Read in libdvdnav

Executive Summary

CVE-2026-112057 is a heap out-of-bounds read vulnerability in the libdvdnav library, which handles DVD navigation. It occurs when a crafted DVD or disc image supplies an oversized vts_ttn value that exceeds the size of the part-of-title array. This causes applications enumerating chapters to read memory beyond allocated buffers, potentially leading to crashes or information leaks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems using libdvdnav versions before 7.0.0. Check for crashes in applications like VLC or other media players when processing DVDs. Monitor logs for heap out-of-bounds read errors or wild pointer dereferences during DVD navigation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using libdvdnav to crash when processing malicious DVDs or disc images. It may also expose sensitive memory contents, though exploitation requires an attacker to provide a specially crafted DVD or disc image.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes application crashes or information leaks due to memory over-reads. It does not directly impact compliance with GDPR or HIPAA, as those standards focus on data protection, privacy, and security controls rather than memory safety issues in DVD navigation libraries.

Useful 0 Not Useful 0

Mitigation Strategies

Update libdvdnav to version 7.0.0 or later. If updating is not immediately possible, avoid using untrusted DVDs or disc images until the update is applied. Disable or restrict access to DVD playback features in media players if feasible.

Useful 0 Not Useful 0