Live › vulnerability › CVE-2026-112271
Go to dashboardlibdisplay-info through 0.4.0 has a heap out-of-bounds read in its DisplayID v1 section parser when a data block's declared length exceeds the section. A crafted EDID from a malicious monitor, KVM, capture device or EDID file can make the library read past its buffer and possibly crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that parse EDID data with libdisplay-info 0.4.0 or earlier, such as desktop compositors and display tools that read monitor EDID from attached hardware or files. The sources do not say which distributions or applications ship it, so whether a given host is exposed is unknown.
No product ranges from the sources yet.
unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash.
This page as .md · .json · in your agent: get_signal("CVE-2026-112271")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.