CVE-2026-112281 Details
Description
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.
A stack-based buffer overflow vulnerability has been identified in libaribb24 versions through 1.0.3. The issue resides in the function decoder_handle_csi() within src/decoder.c. This vulnerability allows attackers to write past a fixed 256-entry array by sending unbounded CSI parameter bytes. By embedding a caption statement with a CSI introducer and more than 256 parameter bytes into media files or broadcast streams, attackers can crash FFmpeg or VLC, or corrupt the return address.
No fixed release is available. However, the vulnerability can be addressed by modifying the libaribb24 code to include bounds checks on the CSI parameter index before writing to the buffer, and by ensuring that the caption data units are properly validated before being processed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/cve-2026-112280-112281-aribb24-caption-data-unit-and-csi-oob-write | CISA-ADP | BundleExploitRemedyTechnical Analysis |
| https://github.com/nkoriyama/aribb24/blob/v1.0.3/src/decoder.c | [email protected] | Source CodeVendor |
| https://hackmd.io/@haindpwn/aribb24-caption-data-unit-and-csi-oob-write | [email protected] | BundleExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/libaribb24-through-1.0.3-stack-buffer-overflow-via-decoder-handle-csi | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libaribb24 | <= 1.0.3 (semver) |
CPE
Remediation
| |
| FFmpeg | All versions |
CPE
Remediation
| |
| VLC | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |