{"id":"CVE-2026-112284","kind":"vulnerability","aliases":["CVE-2026-112284"],"related":[],"title":"libaribcaption: crafted captions read past a table, leaking memory or crashing","description":"libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.","summary":"libaribcaption, a library that decodes Japanese broadcast captions, reads past the end of an internal 78-entry table when a caption selects the Latin special character set. An attacker who supplies a crafted caption can leak adjacent read-only memory or crash the decoder.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["broadcast-captions","libaribcaption","media-pipeline","package"],"not_affected_if":["no-untrusted-caption-input","not-using-1.1.0-to-1.1.2"],"how_to_check":"- Run `pkg-config --modversion libaribcaption` or check the vendored copy's version in your build files, and look for `1.1.0` through `1.1.2`.\n- Search dependencies for libaribcaption with `grep -ri libaribcaption` in your build or lock files.","fix":"- Move to a libaribcaption release newer than `1.1.2`; the sources do not name the exact fixed version, so check the upstream project's release notes.\n- Until patched, avoid decoding captions from untrusted streams with the affected version.","status":"open","published_at":"2026-10-19T14:17:06+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:33:29+00:00","updated_at":"2026-10-25T04:33:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:33:29Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a libaribcaption release newer than `1.1.2`; the sources do not name the exact fixed version, so check the upstream project's release notes.\n- Until patched, avoid decoding captions from untrusted streams with the affected version.","reach":"unknown","title":"libaribcaption: crafted captions read past a table, leaking memory or crashing","impact":"low","summary":"libaribcaption, a library that decodes Japanese broadcast captions, reads past the end of an internal 78-entry table when a caption selects the Latin special character set. An attacker who supplies a crafted caption can leak adjacent read-only memory or crash the decoder.","category":"package","nicknames":[],"who_cares":["libaribcaption","media-pipeline","broadcast-captions"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker leaks adjacent memory or crashes the caption decoder","analyst_note":"Confirm the fixed version and whether the flaw can go beyond a leak or crash; the NVD page is the only source given.","how_to_check":"- Run `pkg-config --modversion libaribcaption` or check the vendored copy's version in your build files, and look for `1.1.0` through `1.1.2`.\n- Search dependencies for libaribcaption with `grep -ri libaribcaption` in your build or lock files.","needs_analyst":true,"not_affected_if":["no-untrusted-caption-input","not-using-1.1.0-to-1.1.2"],"who_is_affected":"Applications that embed libaribcaption to decode ARIB caption data from broadcast or transport streams, such as media players, recorders or transcoders. Exposure depends on whether untrusted caption input reaches the decoder; systems that never decode arbitrary broadcast captions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000662,"input_tokens":3376,"output_tokens":648,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112284':14A,17A '-2026':13A,16A '0x6f':116C '0x6f-0x7e':115C '0x7e':117C '1.1.0':72C '1.1.2':74C '28':110C '4c':111C '78':41B,90C 'adjac':62B,120C 'attack':54B,98C 'bound':81C,96C 'broadcast':19B,32B 'broadcast-capt':18B 'byte':114C 'caption':3A,20B,33B,46B,59B,102C 'charact':51B 'check':97C 'contain':75C 'craft':2A,58B,101C 'crash':11A,68B,126C 'cve':12A,15A 'data':124C 'decod':30B,70B,127C 'decoderimpl':84C 'design':103C 'end':37B 'entri':42B,91C 'esc':109C 'follow':112C 'global':77C 'handleglgr':85C 'intern':40B 'japanes':31B 'klatinspecialt':92C 'latin':49B,105C 'leak':8A,61B,119C 'libaribcapt':1A,21B,26B,71C 'librari':28B 'media':23B 'media-pipelin':22B 'memori':9A,66B 'out-of-bound':78C 'packag':25B 'past':5A,35B,88C 'pipelin':24B 'read':4A,34B,64B,82C,87C,122C 'read-on':63B,121C 'select':47B 'set':52B,107C 'special':50B,106C 'suppli':56B,100C 'tabl':7A,43B 'upper':95C 'without':93C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed libaribcaption to decode ARIB caption data from broadcast or transport streams, such as media players, recorders or transcoders. Exposure depends on whether untrusted caption input reaches the decoder; systems that never decode arbitrary broadcast captions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112284","severity":null,"published_at":"2026-10-19T14:17:06+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}