Description
VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.
Published: 2026-10-18
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via out-of-bounds read
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an out-of-bounds read in libdvdnav's handling of the set_PTT function. An attacker can craft a DVD containing an invalid JumpTT title number, causing the player to read past the heap title table and crash. This results in a denial of service; no escalation of privileges or code execution is described. The flaw stems from missing validation of the title parameter, which CWE-125 highlights.

Affected Systems

VideoLAN's libdvdnav library up to and including version 7.0.0 is affected. This library is widely used in DVD playback applications such as VLC, allowing many systems that ship with libdvdnav 7.0.0 or earlier to be vulnerable.

Risk and Exploitability

The CVSS score of 6.8 indicates moderate severity. EPSS is not available, and the vulnerability is not documented in CISA's KEV catalog. An attacker would need to supply a malicious DVD or disc image that is processed by the library. If the user opens or plays such media, the library will attempt to use an invalid title index, resulting in a crash. No network exposure is required, making this a local or user‑initiated risk.

Generated by OpenCVE AI on October 18, 2026 at 13:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libdvdnav to version 7.0.1 or later, which fixes the out-of-bounds read in set_PTT.
  • If an official update is not yet available, replace the library with a patched source that performs bounds checking on the JumpTT title number, or apply a community‑provided patch from the VideoLAN repository.
  • As a temporary measure, restrict media access to trusted users or disable automatic DVD parsing until the patch can be applied.

Generated by OpenCVE AI on October 18, 2026 at 13:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Videolan
Videolan libdvdnav
Vendors & Products Videolan
Videolan libdvdnav

Mon, 19 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Sun, 18 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.
Title libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Videolan Libdvdnav
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T20:30:01.860Z

Reserved: 2026-10-18T11:54:43.513Z

Link: CVE-2026-112058

cve-icon Vulnrichment

Updated: 2026-10-19T20:29:31.258Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-18T13:16:38.167

Modified: 2026-10-19T21:17:06.370

Link: CVE-2026-112058

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T12:19:48Z

Links: CVE-2026-112058 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T17:01:54Z

Weaknesses