Live › vulnerability › CVE-2026-112282
Go to dashboardlibbluray, the Blu-ray disc playback library, has an out-of-bounds read in clpi_access_point() when a .clpi file in BDMV/CLIPINF has an empty EP-map fine table. An attacker who supplies a crafted disc structure can crash the application that seeks within it, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that open untrusted Blu-ray disc images or folders with libbluray 1.5.1 or earlier, usually through a media player or transcoder that links the library. Teams that only play their own discs or do not handle Blu-ray content can skip it. The sources do not name a patched release.
No product ranges from the sources yet.
bd_get_version or check the installed libbluray version with pkg-config --modversion libbluray and confirm whether it is 1.5.1 or earlier.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num_ep_fine set to zero and an unclamped ref_ep_fine_id, triggering reads during seeking for denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-112282")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.