Global Out-of-Bounds Read in libaribcaption Affects Multiple Versions
CVE-2026-112284

4.8MEDIUM

Key Information:

Vendor

Xqq

Status
Libaribcaption
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112284?

A vulnerability exists in libaribcaption versions 1.1.0 through 1.1.2 due to a global out-of-bounds read flaw in the DecoderImpl::HandleGLGR function. The issue arises when processing specially crafted captions that contain the Latin special character set. An attacker can exploit this vulnerability by supplying a maliciously constructed caption, triggering a read operation that exceeds the intended boundary of the kLatinSpecialTable. This out-of-bounds access may lead to the exposure of sensitive adjacent read-only data or induce a crash during the decoding process, posing significant risks to application integrity and data confidentiality.

Affected Version(s)

libaribcaption 1.1.0 <= 1.1.2

References

https://hackmd.io/@haindpwn/libaribcaption-latin-special-...
third-party-advisory
https://github.com/xqq/libaribcaption/blob/v1.1.2/src/dec...
technical-description
https://github.com/xqq/libaribcaption/blob/v1.1.2/src/dec...
technical-description

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.