Heap-Based Buffer Overflow in libaribb24 Affects FFmpeg and VLC
CVE-2026-112280

6.9MEDIUM

Key Information:

Vendor

Nkoriyama

Status
Aribb24
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112280?

libaribb24 version 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c. This flaw allows attackers to manipulate heap memory through oversized caption data units. By crafting a malicious caption PES packet within a media file or broadcast stream that is processed by the arib_parse_pes() function, attackers can cause applications like FFmpeg or VLC to crash, and potentially lead to further memory corruption. This vulnerability poses a significant risk to media processing applications that rely on libaribb24 for caption parsing.

Affected Version(s)

aribb24 0 <= 1.0.3

References

https://hackmd.io/@haindpwn/aribb24-caption-data-unit-and...
third-party-advisory
https://github.com/nkoriyama/aribb24/blob/v1.0.3/src/pars...
technical-description
https://www.vulncheck.com/advisories/libaribb24-aribb24-t...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.