CVE-2026-112272

MediumCVSS 5.5

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c. Attackers can supply a crafted EDID with oversized data block lengths, causing reads past the buffer and crashing applications.

Risk Assessment

This can lead to denial of service (application crash) when processing untrusted EDID data from monitors, KVMs, capture devices, or files.

Recommendation

Update libdisplay-info to a version later than 0.4.0 or apply the vendor patch. Avoid processing untrusted EDID data.

Other vulnerabilities in libdisplay-info

CVE-2026-112271Medium
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c. Attackers can supply a crafted EDID with a data block length exceeding the section, causing is_all_zeroes to read past the buffer and potentially crash.

Original NVD description (English source)

Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS