OESA-2026-4693: zvbi security update
The ZVBI library provides functions to read from Linux V4L, V4L2 and FreeBSD BKTR raw VBI capture devices, from Linux DVB devices and from a VBI proxy to share V4L and V4L2 VBI devices between multiple applications. It can demodulate raw to sliced VBI data in software, with support for a wide range of formats, has functions to decode several popular services including Teletext and Closed Caption, a Teletext cache with search function, various text export and rendering functions. Security Fix(es):
libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbidecode with every slot set to DRCSMODE654, causing convertdrcs to overflow chars[48][60] and crash the application.(CVE-2026-110654)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/zvbito a version that resolves this vulnerability.Fixed in 0.2.44-3.oe2403sp3
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libzvbi through 0.2.45 that decode Teletext data via vbi_decode are exposed when they process a crafted Teletext stream. The vulnerable decoding path handles X/28/3 packets containing DRCS pixel-mode values.
What does an attacker need to exploit it?
An attacker needs to supply a crafted Teletext stream that is decoded by the application. The supplied data sets every slot to DRCS_MODE_6_5_4, causing convert_drcs to write beyond the chars[48][60] buffer; no privileges are required, but user interaction is required.
What is the expected impact?
The out-of-bounds write can corrupt memory and crash the application processing the stream. The advisory rates availability impact as high and integrity impact as low, with no stated confidentiality impact.