CVE-2026-112272 Details
Description
Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications.
A heap out-of-bounds read vulnerability has been identified in libdisplay-info version 0.4.0. The issue arises in the DisplayID v2 section parser within displayid2.c. This vulnerability allows attackers to read beyond the EDID buffer by exploiting oversized data block lengths. Attackers can deliver a crafted EDID from a malicious monitor, KVM, capture device, or file, which over-advances the parsing cursor and causes applications to crash.
Users are advised to update to the patched version of libdisplay-info, which includes fixes for the DisplayID v1 and v2 parsers. The update should be applied as part of the regular maintenance process for dependencies.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/libdisplay-info-displayid-datablock-overrun-oob-read | CISA-ADP | BundleExploitTechnical Analysis |
| https://gitlab.freedesktop.org/emersion/libdisplay-info | [email protected] | Permission RequiredVendor |
| https://gitlab.freedesktop.org/emersion/libdisplay-info/-/blob/0.4.0/displayid2.c#L84-L143 | [email protected] | Permission RequiredSource CodeVendor |
| https://hackmd.io/@haindpwn/libdisplay-info-displayid-datablock-overrun-oob-read | [email protected] | BundleExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/libdisplay-info-0.4.0-heap-out-of-bounds-read-via-displayid-v2-parser | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libdisplay-info | 0.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |