A heap out-of-bounds read occurs in libdvdnav before 7.0.0 due to dvdnav_describe_title_chapters accessing memory beyond the part-of-title array when a crafted vts_ttn value is supplied. This flaw allows an attacker to read arbitrary data from the process’s memory and can cause the application to crash during chapter enumeration, leading to denial of service and indirect information disclosure.

The vulnerable component is libdvdnav from VideoLAN, used in DVD playback software. All releases prior to 7.0.0, including the 6.x series (e.g., 6.1.1), are affected. Any exploit requires a DVD or disc image that declares a title count (vts_ttn) larger than the actual title set entries.

The CVSS score of 6.8 indicates moderate severity. EPSS is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in CISA KEV. Attackers would need to provide a malicious DVD image or craft disc data; the flaw is not remotely exploitable over a network. The risk is confined to systems that parse DVD media with the vulnerable library and is mitigated by avoiding such media or by restricting the scope of chapter enumeration.