Read the docs
TI-2026-76480 Aliases CVE-2026-112280GHSA-pgf4-9h53-rfcj

Heap buffer overflow in libaribb24 parser lets crafted streams crash FFmpeg

Priority LOW 29CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. An attacker who supplies a crafted caption PES packet in a media file or broadcast stream can crash FFmpeg or VLC and possibly corrupt further memory. Exploitation requires a user to open the crafted file or stream. CVSS 4.0 scores it 6.9 (Medium).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00132 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nkoriyamaaribb24up to 1.0.3—No fix listedCNA
  • aribb24 Vendornkoriyama Affected up to 1.0.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libaribb24 (aribb24).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-112280
  2. 2026-10-19 Alias added: GHSA-pgf4-9h53-rfcj

References

Advisory 1

Other 1

  • TI-2026-76481 Stack buffer overflow in libaribb24 decoder_handle_csi CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences