CVE-2026-112284: libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.
Affected Software
Event History
Frequently Asked Questions
What input must an attacker control to trigger the issue?
An attacker must be able to supply crafted caption data to a vulnerable decoder. The caption designates the Latin special set with ESC 28 4C and then uses bytes in the 0x6F-0x7E range.
What are the practical effects of successful exploitation?
The out-of-bounds read can disclose adjacent read-only data or cause caption decoding to crash. The provided severity vector indicates local attack vector, no privileges required, and user interaction required.
Which releases are affected?
libaribcaption versions 1.1.0 through 1.1.2 are affected.