This vulnerability is an out-of-bounds write in the Teletext decoder of libzvbi. Malicious unfiltered pixel-mode values can overflow the internal chars[48][60] array during the convert_drcs function. The resulting memory corruption can corrupt stack or heap data and leads to the decoding process crashing or terminating unexpectedly.

The flaw affects all versions of the zapping-vbi libzvbi library up to and including 0.2.45. Systems that embed this library for decoding Teletext streams such as digital television receivers or set-top boxes are potentially vulnerable if they use an unpatched copy of the library.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation. The vulnerability is triggered by externally supplied Teletext data, which could originate from broadcast signals or file inputs. It is therefore plausible that a remote attacker delivering a malicious stream or file could trigger the out-of-bounds write, causing a denial of service. The vulnerability is not listed in the CISA KEV catalog.