CVE-2026-112058: libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT
VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in setPTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using VideoLAN libdvdnav through version 7.0.0 are exposed when they process an attacker-controlled DVD or disc image containing a malicious First Play program chain.
What must an attacker provide to trigger the crash?
The attacker must supply a DVD or disc image whose First Play program chain issues a JumpTT command with title number 0 or an oversized title number. User interaction is required to process the malicious media.
What is the impact of successful exploitation?
The invalid title number causes an out-of-bounds read past the heap title table, which can crash the application. The provided data identifies availability impact only, with no confidentiality or integrity impact.