The vulnerability lies in the displayid2.c parser that reads an oversized EDID data block. An attacker can provide a crafted EDID from a monitor, KVM, capture device, or file, causing the parser to read past the allocated buffer. This out‑of‑bounds read can disclose arbitrary heap contents to the attacker and may trigger a crash in the consuming application. The flaw is classified as CWE‑125, an out‑of‑bounds read weakness.

The affected product is emersion libdisplay-info, version 0.4.0. This library is used by desktop display managers and tools that parse EDID information. Any system component that loads this library for EDID processing is potentially vulnerable until the issue is fixed.

With a CVSS score of 6.8 the vulnerability is of moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires control over an EDID source; an attacker can supply a malicious monitor or a crafted file without requiring elevated privileges. Successful exploitation may cause a crash or leak of data from the application’s heap, which could aid further attacks depending on the exposure of that data. The risk remains moderate to high in environments that automatically trust EDID data from external devices.