CVE-2026-110654: libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs
libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbidecode with every slot set to DRCSMODE654, causing convertdrcs to overflow chars[48][60] and crash the application.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to provide to trigger the flaw?
The attacker must be able to supply a crafted Teletext stream that the application decodes through vbi_decode. The malicious stream uses X/28/3 packets with DRCS pixel-mode values set to DRCS_MODE_6_5_4 in every slot.
What is the practical impact described for a successful exploit?
The crafted packets cause convert_drcs to write beyond the chars[48][60] buffer, corrupting memory. The documented outcome is that the application can crash.
Which deployments are exposed?
Applications using libzvbi through 0.2.45 are affected when they decode attacker-controlled Teletext streams via vbi_decode. The provided data does not identify a safe configuration or mitigation other than avoiding decoding untrusted streams.