CVE-2026-112284 Details
Description
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.
A global out-of-bounds read vulnerability has been identified in libaribcaption versions 1.1.0 through 1.1.2. The issue arises in the 'DecoderImpl::HandleGLGR' function, where the decoder reads past the bounds of the 'kLatinSpecialTable', a conversion table with only 78 entries, without proper validation. This flaw can be exploited by crafting captions that include specific escape sequences to access adjacent read-only data or potentially crash the decoding process.
Users can update to libaribcaption version 1.1.3 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/libaribcaption-latin-special-table-oob-read | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/xqq/libaribcaption/blob/v1.1.2/src/decoder/b24_conv_tables.hpp | [email protected] | Source CodeVendor |
| https://github.com/xqq/libaribcaption/blob/v1.1.2/src/decoder/decoder_impl.cpp | [email protected] | Source CodeVendor |
| https://github.com/xqq/libaribcaption/commit/9917cb311c93d884cb820d122911a211042da26c | [email protected] | Source CodeVendor |
| https://hackmd.io/@haindpwn/libaribcaption-latin-special-table-oob-read | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/libaribcaption-1.1.0-through-1.1.2-out-of-bounds-read-via-decoderimpl-handleglgr | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libaribcaption | >= 1.1.0, <= 1.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |