CVE-2026-112282: VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point

Q: What conditions are required to trigger the crash?

An attacker must supply a crafted ClipInfo (.clpi) file in BDMV/CLIPINF. The file must have an empty EP-map fine table with num_ep_fine set to zero and an unclamped ref_ep_fine_id; the out-of-bounds read is triggered during seeking.

Q: Which applications are exposed?

Applications using VideoLAN libbluray through version 1.5.1 may be affected if they process attacker-controlled Blu-ray directory content containing the crafted .clpi file and perform seeking.

Q: What is the expected impact of successful exploitation?

Successful exploitation can crash the affected application, causing a denial of service. The provided information does not indicate confidentiality or integrity impact.

Published Oct 19, 2026

Updated

VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpiaccesspoint() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with numepfine set to zero and an unclamped refepfineid, triggering reads during seeking for denial of service.

Affected Software

1 affected component

Videolan Libbluray<=1.5.1

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Event

via NVD·03:41 PM

Frequently Asked Questions

What conditions are required to trigger the crash?

An attacker must supply a crafted ClipInfo (.clpi) file in BDMV/CLIPINF. The file must have an empty EP-map fine table with num_ep_fine set to zero and an unclamped ref_ep_fine_id; the out-of-bounds read is triggered during seeking.

Which applications are exposed?

Applications using VideoLAN libbluray through version 1.5.1 may be affected if they process attacker-controlled Blu-ray directory content containing the crafted .clpi file and perform seeking.

What is the expected impact of successful exploitation?

Successful exploitation can crash the affected application, causing a denial of service. The provided information does not indicate confidentiality or integrity impact.

CVE-2026-112282: VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point

Affected Software

Event History

Frequently Asked Questions

What conditions are required to trigger the crash?

Which applications are exposed?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the crash?

Which applications are exposed?

What is the expected impact of successful exploitation?