CVE-2026-112272: libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser
Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications.
Affected Software
Event History
Frequently Asked Questions
What inputs could expose an application to this issue?
An application is exposed when it parses EDID data supplied by a malicious monitor, KVM, capture device, or file. The crafted EDID uses oversized DisplayID v2 data-block lengths to move the parser cursor beyond the EDID buffer.
Does exploiting this require prior access or user interaction?
The listed vector is local, with no privileges required and user interaction required. The available data does not further specify the interaction needed for a particular delivery path.
What is the practical impact of a successful exploit?
The vulnerability can cause the application to read past the heap buffer and crash. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.