The vulnerability is a stack-based buffer overflow in decoder_handle_csi() of libaribb24, which accepts CSI parameter bytes without bounds checking. An attacker can embed a caption statement containing more than 256 parameter bytes into a media file or broadcast stream; when the library processes this, it writes past the fixed 256-entry array and can corrupt the return address or cause a crash. The result is a loss of confidentiality, integrity, or availability depending on how the corrupted data is used.

The affected product is aribb24 version 1.0.3 or earlier, supplied by the vendor nkoriyama. Software that incorporates this library for caption decoding, such as FFmpeg and VLC, is at risk when processing maliciously crafted media. Any system running a vulnerable build of libaribb24 is potentially impacted if an attacker can provide an input stream that triggers the overflow.

The CVSS score of 6.9 reflects moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation yet. The likely attack vector is activity involving the processing of untrusted media containing overly long CSI parameter sequences; successful exploitation would crash the media player or potentially allow more advanced code execution if a suitable return address overwrite is achieved.