Stack-Based Buffer Overflow in libaribb24 Affects Media Playback Software
CVE-2026-112281

6.9MEDIUM

Key Information:

Vendor

Nkoriyama

Status
Aribb24
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112281?

libaribb24 version 1.0.3 is impacted by a stack-based buffer overflow vulnerability in the decoder_handle_csi() function, located in src/decoder.c. This flaw arises from inadequate bounds checking on the amount of caption parameter data processed. By exploiting this vulnerability, attackers can craft malicious media files or broadcast streams with an embedded caption that includes a CSI introducer and an excessive number of parameter bytes beyond the fixed 256-entry limit. Successful exploitation may lead to application crashes in popular media players such as FFmpeg or VLC, or potentially allow attackers to overwrite critical memory locations, resulting in undefined behavior or system instability.

Affected Version(s)

aribb24 0 <= 1.0.3

References

https://hackmd.io/@haindpwn/aribb24-caption-data-unit-and...
third-party-advisory
https://github.com/nkoriyama/aribb24/blob/v1.0.3/src/deco...
technical-description
https://www.vulncheck.com/advisories/libaribb24-through-1...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.