VideoLAN libbluray up to version 1.5.1 contains an out-of-bounds read in the clpi_access_point() function. When a ClipInfo file has an empty EP-map fine table, the library performs reads during seeking that exceed the bounds of the data structure, causing the application to crash. The vulnerability does not expose information beyond the crash but lets an attacker interrupt services that rely on libbluray. The flaw is a classic CWE‑125 type condition.

All installations of VideoLAN libbluray version 1.5.1 and earlier are impacted. The vulnerability is documented for the libbluray library shipped with VideoLAN. No specific OEM or distribution variant is singled out, so all binaries derived from libbluray that have not applied the fix are potentially vulnerable.

The CVSS score of 6.8 classifies the flaw as medium severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Attackers need to provide a malicious ClipInfo (.clpi) file; based on the description, the likely attack vector is a local or remote user processing a crafted Blu‑ray disc or stream that contains the file in the BDMV/CLIPINF directory. Once the library parses the file, the out-of-bounds read is triggered and leads to a denial of service. The vulnerability does not allow code execution or data disclosure under the stated conditions.