Out-of-Bounds Read Vulnerability in VideoLAN libdvdnav
CVE-2026-112058

6.8MEDIUM

Key Information:

Vendor

Videolan
Status
Libdvdnav
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112058?

The VideoLAN libdvdnav library, which processes DVD navigation, is susceptible to an out-of-bounds read vulnerability due to improper handling of JumpTT title numbers in the set_PTT function. With this flaw, an attacker may supply an invalid title number, which can lead to reading past the boundaries of allocated memory. This can result in application crashes and potentially disrupt the functionality of any software utilizing this library. Users are advised to review their DVD handling practices and consider updating to secure versions to mitigate exposure to this vulnerability.

Affected Version(s)

libdvdnav 0 <= 7.0.0

References

https://hackmd.io/@haindpwn/libdvdnav-navigation-index-oo...
third-party-advisory
https://code.videolan.org/videolan/libdvdnav/-/blob/7.0.0...
technical-description
https://www.vulncheck.com/advisories/libdvdnav-through-7....
third-party-advisory

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.