VideoLAN libbluray up to the 1.5.1 release contains an uncontrolled memory allocation flaw in the _parse_extent_start_points() routine, which fails to verify the size of the num_point field in parsed .clpi files. A maliciously crafted file can trigger extreme memory allocation, exhausting system resources and depleting CPU cycles, ultimately causing the libbluray process – and any application that relies on it – to halt. The weakness is a classic Uncontrolled Memory Allocation (CWE-789).

All installations of VideoLAN libbluray with a version of 1.5.1 or earlier are affected, including any system that processes Blu‑ray disc image data or local directories containing .clpi files.

The CVSS score of 6.8 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves local or remote possession of a crafted .clpi file and the opportunity for libbluray to parse it, such as by inserting the file on a disc image, mounting a directory processed by the library, or delivering it to a vulnerable application. Successful exploitation leads to a denial of service by exhausting memory and CPU resources.