Description
libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.
Published: 2026-10-19
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Heap Buffer Overflow
Action: Apply Patch
AI Analysis

Impact

A heap‑based buffer overflow exists in the function parse_data_unit_statement_body in src/parser.c of libaribb24. By supplying an oversized caption data unit within a caption PES packet, an attacker can corrupt heap memory and cause a crash in media software such as FFmpeg or VLC, with the possible side effect of further memory corruption.

Affected Systems

The vulnerability affects the library nkoriyama:aribb24. No specific affected versions are listed in the official CNA data; applications that process caption PES packets, such as FFmpeg or VLC, and link against this library may be exposed.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so it is unclear how frequently it is being exploited. Attackers would need to supply a crafted media file or broadcast stream containing the malicious caption packet. Successful exploitation leads to crashes and may facilitate further memory corruption.

Generated by OpenCVE AI on October 19, 2026 at 16:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update aribb24 to a patched version if one is available from the maintainers.
  • If a patch cannot be applied, disable caption parsing or remove the use of aribb24 in the affected media processing chain.
  • Implement input validation that rejects caption data units exceeding an acceptable size before passing them to arib_parse_pes().
  • Use network filters or media sanitizers to block suspicious PES packets from entering the system.

Generated by OpenCVE AI on October 19, 2026 at 16:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.
Title libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T16:34:41.023Z

Reserved: 2026-10-19T13:25:30.552Z

Link: CVE-2026-112280

cve-icon Vulnrichment

Updated: 2026-10-19T15:36:05.887Z

cve-icon NVD

Status : Received

Published: 2026-10-19T14:17:06.117

Modified: 2026-10-19T17:17:15.190

Link: CVE-2026-112280

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:15:07Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow