The libaribcaption project, from 1.1.0 through 1.1.2, has a global out‑of‑bounds read in the DecoderImpl::HandleGLGR function that accesses the 78‑entry Latin special table without performing an upper‑bound check. An attacker who can supply crafted caption data containing the ESC 28 4C sequence followed by bytes in the 0x6F–0x7E range can cause the decoder to read memory beyond the table boundaries, potentially leaking adjacent read‑only data or triggering a crash in the decoding process. The vulnerability does not provide direct code execution but may aid further attacks if sensitive data is exposed or instability is introduced.

Any software that embeds the libaribcaption library in the 1.1.0 to 1.1.2 range and processes captions is impacted. This includes embedded media players, set‑top boxes, streaming software, and other hardware or software that decodes ARIB captions. The problem exists in the single library vendor xqq and affects all releases in the specified range.

The CVSS score of 4.8 places this issue in the moderate‑severity range. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to send malicious caption content to the decoder, so the attack vector is likely application‑level. While no active exploit has been documented, the potential to read unintended data and cause crashes presents a moderate risk that could be leveraged in a broader attack chain.