Description
VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.
Published: 2026-10-18
Score: 6.8 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service via out-of-bounds read
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an out-of-bounds read in libdvdnav's handling of the set_PTT function. An attacker can craft a DVD containing an invalid JumpTT title number, causing the player to read past the heap title table and crash. This results in a denial of service; no escalation of privileges or code execution is described. The flaw stems from missing validation of the title parameter, which CWE-125 highlights.

Affected Systems

VideoLAN's libdvdnav library up to and including version 7.0.0 is affected. This library is widely used in DVD playback applications such as VLC, allowing many systems that ship with libdvdnav 7.0.0 or earlier to be vulnerable.

Risk and Exploitability

The CVSS score of 6.8 indicates moderate severity. EPSS is not available, and the vulnerability is not documented in CISA's KEV catalog. An attacker would need to supply a malicious DVD or disc image that is processed by the library. If the user opens or plays such media, the library will attempt to use an invalid title index, resulting in a crash. No network exposure is required, making this a local or user‑initiated risk.

Generated by OpenCVE AI on October 18, 2026 at 13:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libdvdnav to version 7.0.1 or later, which fixes the out-of-bounds read in set_PTT.
  • If an official update is not yet available, replace the library with a patched source that performs bounds checking on the JumpTT title number, or apply a community‑provided patch from the VideoLAN repository.
  • As a temporary measure, restrict media access to trusted users or disable automatic DVD parsing until the patch can be applied.

Generated by OpenCVE AI on October 18, 2026 at 13:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.
Title libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-18T12:19:48.829Z

Reserved: 2026-10-18T11:54:43.513Z

Link: CVE-2026-112058

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T13:16:38.167

Modified: 2026-10-18T13:16:38.167

Link: CVE-2026-112058

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T13:45:14Z

Weaknesses