CVE-2026-112282

MediumCVSS 5.5

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num_ep_fine set to zero and an unclamped ref_ep_fine_id, triggering reads during seeking for denial of service.

Risk Assessment

Invalid memory reads can crash playback applications, resulting in denial of service.

Recommendation

Upgrade libbluray beyond 1.5.1 and avoid playing untrusted .clpi files until the fix is deployed.

Other vulnerabilities in libbluray

CVE-2026-112283Medium
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS