MGASA-2026-0576: Updated zvbi package fixes a security vulnerability
libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbidecode with every slot set to DRCSMODE654, causing convertdrcs to overflow chars[48][60] and crash the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mageia/zvbito a version that resolves this vulnerability.Fixed in 0.2.44-3.mga10
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Mageia's zvbi package are exposed when an application decodes attacker-controlled Teletext streams through vbi_decode. The vulnerable component is libzvbi through version 0.2.45.
What does an attacker need to provide to trigger the flaw?
An attacker needs to supply a crafted Teletext stream containing X/28/3 packets with DRCS pixel-mode values. A stream with every slot set to DRCS_MODE_6_5_4 can overflow the chars[48][60] buffer in convert_drcs and crash the application.
How can I identify systems that need attention?
Identify systems running applications that use libzvbi or the Mageia zvbi package, especially where those applications process Teletext data from untrusted sources. Check whether the installed libzvbi version is 0.2.45 or earlier.