TI-2026-76185 Aliases CVE-2026-112057 GHSA-2m5j-rc78-vx58

libdvdnav Out-of-Bounds Read in dvdnav_describe_title_chapters

MEDIUM 63CWE-125Published 2026-10-18 · Updated 2026-10-19

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

libdvdnav before 7.0.0 contains a heap out-of-bounds read in dvdnav_describe_title_chapters (CWE-125). A crafted DVD or disc image declares a VMGI title vts_ttn larger than the title set's entries, so the function reads beyond the part-of-title array. An attacker who supplies such a disc can crash applications that enumerate chapters. Red Hat rates it Moderate.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vts_ttn than the title set's entries to crash applications enumerating chapters.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00182 7th percentileScored 2026-11-07

Fix Partial libdvdnav (VideoLAN): 7.0.0Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VideoLAN	libdvdnav	before 7.0.0	7.0.0	Patch available	CNA

libdvdnav VendorVideoLAN Affected before 7.0.0 Fixed in 7.0.0 Patch available CNA

Remediation

Upgrade libdvdnav to version 7.0.0 or later, which contains the fix. Red Hat Enterprise Linux 7, 8, 9 and 10 have no fix available yet.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA libdvdnav (VideoLAN) Fixed in 7.0.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-18 Threatist record created from CVE-2026-112057
2026-10-18 Alias added: GHSA-2m5j-rc78-vx58
2026-10-18 Affected versions changed · Red Hat
2026-10-18 CVSS score added · Red Hat
2026-10-19 Priority changed: MEDIUM → LOW
2026-10-20 CISA SSVC decision points changed
2026-10-20 Priority changed: LOW → MEDIUM

References

TI-2010-03131 libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers… CVSS 2.0HIGH 9.3
TI-2023-25623 Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a… CVSS 3.1CRITICAL 9.8
TI-2008-04437 Stack-based buffer overflow in the parse_master function in the Ty demux plugin… CVSS 2.0HIGH 9.3
TI-2023-25624 Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. CVSS 3.1HIGH 7.5
TI-2022-19821 An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4… CVSS 3.1HIGH 7.8
TI-2012-01563 Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote… CVSS 2.0HIGH 9.3

See all 137 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences