TI-2026-76482 Aliases CVE-2026-112282 GHSA-x3j6-3979-c9q8

Out-of-bounds read in VideoLAN libbluray allows denial of service

MEDIUM 63CWE-125Published 2026-10-19 · Updated 2026-10-19

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

VideoLAN libbluray through 1.5.1 contains an out-of-bounds read (CWE-125) in clpi_access_point(). A crafted .clpi file in BDMV/CLIPINF with an empty EP-map fine table causes reads past the table during seeking. An attacker who can supply such a file can crash applications, causing a denial of service, when a user seeks within the content.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num_ep_fine set to zero and an unclamped ref_ep_fine_id, triggering reads during seeking for denial of service.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0018 7th percentileScored 2026-11-07

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VideoLAN	libbluray	up to 1.5.1	—	No fix listed	CNA

libbluray VendorVideoLAN Affected up to 1.5.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for VideoLAN libbluray. Red Hat lists Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8 as affected without a fix, with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred

Timeline

2026-10-19 Threatist record created from CVE-2026-112282
2026-10-19 Alias added: GHSA-x3j6-3979-c9q8
2026-10-20 CISA SSVC decision points changed
2026-10-20 Affected versions changed · Red Hat
2026-10-20 CVSS score added · Red Hat

References

Advisory 1

https://hackmd.io/@haindpwn/libbluray-clpi-ep-map-oob-read

Other 1

https://code.videolan.org/videolan/libbluray/-/blob/1.5.1/src/libbluray/bdnav/clpi_parse.c

TI-2010-03131 libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers… CVSS 2.0HIGH 9.3
TI-2023-25623 Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a… CVSS 3.1CRITICAL 9.8
TI-2008-04437 Stack-based buffer overflow in the parse_master function in the Ty demux plugin… CVSS 2.0HIGH 9.3
TI-2023-25624 Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. CVSS 3.1HIGH 7.5
TI-2022-19821 An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4… CVSS 3.1HIGH 7.8
TI-2012-01563 Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote… CVSS 2.0HIGH 9.3

See all 137 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences