CVE-2026-112281: libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi

Q: Who is exposed to this issue?

Applications that use libaribb24 to decode attacker-controlled media files or broadcast streams are exposed. The supplied examples identify FFmpeg and VLC as applications that can be crashed when processing crafted caption data.

Q: What must an attacker provide to trigger the overflow?

The attacker needs to supply media content or a broadcast stream containing a caption statement with a CSI introducer followed by more than 256 CSI parameter bytes. Exploitation requires the vulnerable decoder to process that caption data.

Q: Is user interaction required?

Yes. The vector specifies user interaction is required, and the described attack relies on a target application processing a crafted media file or broadcast stream.

Q: What is the impact if exploitation succeeds?

The overflow can crash the consuming application, such as FFmpeg or VLC, and may corrupt the return address. The provided severity vector indicates high availability impact and low integrity impact, with no confidentiality impact.

Published Oct 19, 2026

Updated

libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoderhandlecsi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.

Affected Software

1 affected component

libaribb24 aribb24<=1.0.3

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications that use libaribb24 to decode attacker-controlled media files or broadcast streams are exposed. The supplied examples identify FFmpeg and VLC as applications that can be crashed when processing crafted caption data.

What must an attacker provide to trigger the overflow?

The attacker needs to supply media content or a broadcast stream containing a caption statement with a CSI introducer followed by more than 256 CSI parameter bytes. Exploitation requires the vulnerable decoder to process that caption data.

Is user interaction required?

Yes. The vector specifies user interaction is required, and the described attack relies on a target application processing a crafted media file or broadcast stream.

What is the impact if exploitation succeeds?

The overflow can crash the consuming application, such as FFmpeg or VLC, and may corrupt the return address. The provided severity vector indicates high availability impact and low integrity impact, with no confidentiality impact.

CVE-2026-112281: libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker provide to trigger the overflow?

Is user interaction required?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker provide to trigger the overflow?

Is user interaction required?

What is the impact if exploitation succeeds?