{"id":"CVE-2026-112280","kind":"vulnerability","aliases":["CVE-2026-112280"],"related":[],"title":"libaribb24: heap overflow in caption parser lets crafted media crash players","description":"libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.","summary":"libaribb24 through 1.0.3 has a heap-based buffer overflow in src/parser.c when it parses an oversized caption data unit. A crafted caption PES packet in a media file or broadcast stream, processed by arib_parse_pes(), can crash FFmpeg or VLC and may corrupt further memory.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libaribb24","media-processing","package","vlc"],"not_affected_if":["no-aribb24-library","trusted-media-only"],"how_to_check":"- Check whether the `aribb24` library is installed, for example with `pkg-config --modversion aribb24` or by looking for libaribb24 in your package manager.\n- Check whether FFmpeg or VLC on the system is built with libaribb24 support.","fix":null,"status":"open","published_at":"2026-10-19T14:17:06+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:40:50+00:00","updated_at":"2026-10-25T03:40:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:40:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"libaribb24: heap overflow in caption parser lets crafted media crash players","impact":"medium","summary":"libaribb24 through 1.0.3 has a heap-based buffer overflow in src/parser.c when it parses an oversized caption data unit. A crafted caption PES packet in a media file or broadcast stream, processed by arib_parse_pes(), can crash FFmpeg or VLC and may corrupt further memory.","category":"package","nicknames":[],"who_cares":["ffmpeg","vlc","media-processing","libaribb24"],"confidence":0.6,"needs_auth":"no","worst_case":"crashes the player and may corrupt further memory","analyst_note":"Find the fixed version and any upstream patch for libaribb24 1.0.3 at the NVD entry or the project repository, and confirm whether code execution is possible.","how_to_check":"- Check whether the `aribb24` library is installed, for example with `pkg-config --modversion aribb24` or by looking for libaribb24 in your package manager.\n- Check whether FFmpeg or VLC on the system is built with libaribb24 support.","needs_analyst":true,"not_affected_if":["no-aribb24-library","trusted-media-only"],"who_is_affected":"Systems that decode ARIB caption data from media files or broadcast streams through libaribb24, typically via FFmpeg or VLC builds that use it. Machines that do not process Japanese broadcast captions with this library, or that only play trusted local media, have much less exposure. The sources do not name a fixed version.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000628,"input_tokens":3367,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112280':14A,17A '-2026':13A,16A '1.0.3':27B,75C 'allow':87C 'arib':59B,116C 'aribb24':73C 'attack':88C,99C 'base':32B,80C 'broadcast':55B,112C 'buffer':33B,81C 'caption':5A,42B,47B,96C,104C 'contain':76C 'corrupt':69B,90C,126C 'craft':8A,46B,103C 'crash':10A,63B,120C 'cve':12A,15A 'data':43B,97C 'ffmpeg':18B,64B,121C 'file':53B,110C 'heap':2A,31B,79C,91C 'heap-bas':30B,78C 'let':7A 'libaribb24':1A,19B,25B,72C 'may':68B 'media':9A,21B,52B,109C 'media-process':20B 'memori':71B,92C,128C 'overflow':3A,34B,82C 'overs':41B,95C 'packag':23B 'packet':49B,106C 'pars':39B,60B,117C 'parser':6A 'pes':48B,61B,105C,118C 'player':11A 'possibl':125C 'process':22B,57B,114C 'src/parser.c':36B,85C 'stream':56B,113C 'suppli':101C 'unit':44B,98C 'via':93C 'vlc':24B,66B,123C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode ARIB caption data from media files or broadcast streams through libaribb24, typically via FFmpeg or VLC builds that use it. Machines that do not process Japanese broadcast captions with this library, or that only play trusted local media, have much less exposure. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112280","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112280","severity":null,"published_at":"2026-10-19T14:17:06+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}