CVE-2026-112283: libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in parseextentstartpoints() in clpiparse.c that trusts the numpoint field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge numpoint to exhaust memory and CPU, causing denial of service.
Affected Software
Event History
Frequently Asked Questions
What attacker interaction is required to trigger the denial of service?
An attacker must provide a crafted .clpi file through a disc, disc image, or directory. Exploitation requires a user to process that attacker-controlled media or content.
Which deployments are exposed?
Deployments using VideoLAN libbluray through version 1.5.1 are affected when they parse attacker-controlled .clpi files. The supplied data does not identify a safe fixed version.
What is the expected impact of successful exploitation?
A crafted num_point value can cause excessive memory allocation and CPU consumption, resulting in denial of service. The provided data describes no confidentiality or integrity impact.