TI-2026-76483 Aliases CVE-2026-112283 GHSA-2xfh-28f7-pm5w

Uncontrolled memory allocation in libbluray CLPI file parsing

MEDIUM 63CWE-789Published 2026-10-19 · Updated 2026-10-22

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-789.

Summary

VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation flaw (CWE-789) in _parse_extent_start_points() in clpi_parse.c. The function trusts the num_point field without bounds checking. An attacker who supplies a crafted .clpi file on a disc, image or directory with a large num_point can exhaust memory and CPU, causing denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00182 7th percentileScored 2026-11-07

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VideoLAN	libbluray	up to 1.5.1	—	No fix listed	CNA

libbluray VendorVideoLAN Affected up to 1.5.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libbluray. Red Hat lists Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8 as affected without a fix and with no plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred

Timeline

2026-10-19 Threatist record created from CVE-2026-112283
2026-10-19 Alias added: GHSA-2xfh-28f7-pm5w
2026-10-20 Affected versions changed · Red Hat
2026-10-20 CVSS score added · Red Hat
2026-10-21 Priority changed: MEDIUM → LOW
2026-10-22 CISA SSVC decision points changed
2026-10-22 Priority changed: LOW → MEDIUM

References

Advisory 1

https://hackmd.io/@haindpwn/libbluray-clpi-ep-map-oob-read

Other 1

https://code.videolan.org/videolan/libbluray/-/blob/1.5.1/src/libbluray/bdnav/clpi_parse.c

TI-2010-03131 libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers… CVSS 2.0HIGH 9.3
TI-2023-25623 Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a… CVSS 3.1CRITICAL 9.8
TI-2008-04437 Stack-based buffer overflow in the parse_master function in the Ty demux plugin… CVSS 2.0HIGH 9.3
TI-2023-25624 Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. CVSS 3.1HIGH 7.5
TI-2022-19821 An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4… CVSS 3.1HIGH 7.8
TI-2012-01563 Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote… CVSS 2.0HIGH 9.3

See all 137 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences