CVE-2026-112282: VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point
VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpiaccesspoint() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with numepfine set to zero and an unclamped refepfineid, triggering reads during seeking for denial of service.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
An attacker must supply a crafted ClipInfo (.clpi) file in BDMV/CLIPINF. The file must have an empty EP-map fine table with num_ep_fine set to zero and an unclamped ref_ep_fine_id; the out-of-bounds read is triggered during seeking.
Which applications are exposed?
Applications using VideoLAN libbluray through version 1.5.1 may be affected if they process attacker-controlled Blu-ray directory content containing the crafted .clpi file and perform seeking.
What is the expected impact of successful exploitation?
Successful exploitation can crash the affected application, causing a denial of service. The provided information does not indicate confidentiality or integrity impact.