Live › vulnerability › CVE-2026-112283
Go to dashboardlibbluray, the Blu-ray disc playback library, trusts an unchecked num_point field in .clpi clip metadata when parsing extent start points. A crafted .clpi file on a disc, disc image or directory can make the parser allocate huge amounts of memory and CPU, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that open untrusted Blu-ray discs, disc images or BDMV directories with libbluray, directly or through media players such as VLC or media servers that decode Blu-ray content. Systems that only handle DVDs, or never open disc content from outside sources, are unlikely to be exposed.
No product ranges from the sources yet.
bd_get_version or pkg-config --modversion libbluray; versions through 1.5.1 are in scope.ldconfig -p | grep bluray and confirm which library your media apps link against.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-112283")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.