Live › vulnerability › CVE-2026-112280
Go to dashboardlibaribb24 through 1.0.3 has a heap-based buffer overflow in src/parser.c when it parses an oversized caption data unit. A crafted caption PES packet in a media file or broadcast stream, processed by arib_parse_pes(), can crash FFmpeg or VLC and may corrupt further memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that decode ARIB caption data from media files or broadcast streams through libaribb24, typically via FFmpeg or VLC builds that use it. Machines that do not process Japanese broadcast captions with this library, or that only play trusted local media, have much less exposure. The sources do not name a fixed version.
No product ranges from the sources yet.
aribb24 library is installed, for example with pkg-config --modversion aribb24 or by looking for libaribb24 in your package manager.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-112280")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.