CVE-2026-112057: libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnavdescribetitlechapters that allows attackers to read beyond the part-of-title array by supplying an oversized vtsttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vtsttn than the title set's entries to crash applications enumerating chapters.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using libdvdnav before 7.0.0 are exposed when they enumerate chapters from an attacker-controlled DVD or disc image. The documented impact is an application crash.
What does exploitation require?
An attacker must supply a crafted DVD or disc image whose VMGI title vts_ttn value is larger than the title set's available entries. User interaction is required to cause a local application to process that media.
Is there a mitigation if upgrading is not immediately possible?
Do not process untrusted DVDs or disc images with affected applications, particularly where chapter enumeration may occur. Upgrade libdvdnav to 7.0.0 or later when possible.