CVE-2026-112057 Details
Description
libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vts_ttn than the title set's entries to crash applications enumerating chapters.
A heap out-of-bounds read vulnerability has been identified in libdvdnav versions prior to 7.0.0. The issue arises in the function 'dvdnav_describe_title_chapters', where an oversized 'vts_ttn' value allows attackers to read beyond the allocated 'part-of-title' array. This vulnerability can be exploited by crafting a DVD or disc image that declares a larger 'vts_ttn' value than the corresponding title set entries. As a result, applications that enumerate chapters may crash.
Users are advised to update to libdvdnav version 7.0.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/cve-2026-112057-112058-libdvdnav-navigation-index-oob-read | CISA-ADP | BundleExploitTechnical Analysis |
| https://code.videolan.org/videolan/libdvdnav/-/blob/6.1.1/src/searching.c#L670 | [email protected] | Source CodeVendor |
| https://code.videolan.org/videolan/libdvdnav/-/commit/1d2af48d685911a169fe77d500b1d426910c6f77 | [email protected] | Source CodeVendor |
| https://hackmd.io/@haindpwn/libdvdnav-navigation-index-oob-read | [email protected] | BundleTechnical Analysis |
| https://www.vulncheck.com/advisories/libdvdnav-before-7.0.0-out-of-bounds-read-in-dvdnav-describe-title-chapters | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libdvdnav | >= 0, < 7.0.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |