Heap Out-of-Bounds Read in Libdisplay-info Affects Freedesktop
CVE-2026-112272

6.8MEDIUM

Key Information:

Vendor

Emersion

Status
Libdisplay-info
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112272?

Libdisplay-info version 0.4.0 contains a vulnerability that permits heap out-of-bounds reading in the DisplayID v2 section parser, specifically within the displayid2.c file. This flaw arises when oversized data block lengths allow attackers to craft malicious EDIDs from various sources such as monitors, KVMs, or capture devices. Exploitation of this vulnerability can enable attackers to over-advance the parsing cursor, potentially leading to application crashes and unintended data exposure.

Affected Version(s)

libdisplay-info 0.4.0

References

https://hackmd.io/@haindpwn/libdisplay-info-displayid-dat...
third-party-advisory
https://gitlab.freedesktop.org/emersion/libdisplay-info/-...
technical-description
https://gitlab.freedesktop.org/emersion/libdisplay-info
product

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.