{"id":"CVE-2026-112058","kind":"vulnerability","aliases":["CVE-2026-112058"],"related":[],"title":"libdvdnav: crafted DVD triggers out-of-bounds read and player crash","description":"VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.","summary":"libdvdnav through 7.0.0 has an out-of-bounds read in set_PTT, where an invalid JumpTT title number is checked only by an assert. A crafted DVD or disc image can make a player that uses libdvdnav crash.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dvd-playback","libdvdnav","media-players","package"],"not_affected_if":["no-dvd-playback","untrusted-media-never-opened"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T13:16:38+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:44:55+00:00","updated_at":"2026-10-25T03:44:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:44:55Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"libdvdnav: crafted DVD triggers out-of-bounds read and player crash","impact":"low","summary":"libdvdnav through 7.0.0 has an out-of-bounds read in set_PTT, where an invalid JumpTT title number is checked only by an assert. A crafted DVD or disc image can make a player that uses libdvdnav crash.","category":"package","nicknames":[],"who_cares":["libdvdnav","media-players","dvd-playback"],"confidence":0.6,"needs_auth":"no","worst_case":"Player crashes when opening a crafted disc image","analyst_note":"Find the fixed libdvdnav version and whether an upstream patch replaces the assert with bounds checking, via the NVD entry and the VideoLAN libdvdnav repository.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-dvd-playback","untrusted-media-never-opened"],"who_is_affected":"Applications that link libdvdnav to play DVDs or disc images, such as media players, are exposed when they open untrusted discs or images. Systems that never open optical media or disc images with libdvdnav can skip it. The sources do not name specific fixed versions.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000569,"input_tokens":3363,"output_tokens":465,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112058':15A,18A '-2026':14A,17A '0':116C '7.0.0':29B,69C 'allow':82C 'applic':86C 'assert':51B,98C 'attack':83C,99C 'bound':8A,35B,75C 'chain':111C 'check':47B,94C 'contain':70C 'craft':2A,53B,101C 'crash':12A,65B,85C,128C 'cve':13A,16A 'disc':56B,105C 'dvd':3A,20B,54B,103C 'dvd-playback':19B 'first':108C 'heap':124C 'imag':57B,106C 'invalid':42B,90C 'issu':112C 'jumptt':43B,91C,113C 'libdvdnav':1A,22B,27B,64B,67C 'make':59B 'media':24B 'media-play':23B 'number':45B,93C,120C 'out-of-bound':5A,32B,72C 'overs':119C 'packag':26B 'past':122C 'play':109C 'playback':21B 'player':11A,25B,61B,130C 'program':110C 'ptt':39B,80C 'read':9A,36B,76C,121C 'set':38B,79C 'suppli':88C 'tabl':126C 'titl':44B,92C,115C,125C 'trigger':4A 'use':63B 'videolan':66C 'vulner':77C 'whose':107C","nicknames":[],"mitigations":[],"who_affected":"Applications that link libdvdnav to play DVDs or disc images, such as media players, are exposed when they open untrusted discs or images. Systems that never open optical media or disc images with libdvdnav can skip it. The sources do not name specific fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112058","severity":null,"published_at":"2026-10-18T13:16:38+00:00","modified_at":"2026-10-19T21:17:06+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}