CVE-2026-110654 in libzvbi
Summary
by MITRE • 10/14/2026
libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in libzvbi versions up to 0.2.45 represents a critical memory safety flaw within its Teletext decoding subsystem, specifically affecting the handling of Digital Character Replacement Set or DRCS data. This library is widely utilized for processing Video Broadcast Data, including legacy television standards like teletext and closed captioning. The core issue resides in the function responsible for converting DRCS pixel-mode values during the parsing of X/28/3 packets, which are standard packet types used to transmit extended character sets in digital broadcasting streams. When an attacker supplies unvalidated or maliciously crafted input containing specific DRCS configurations, the decoder fails to perform adequate bounds checking before writing data into internal buffers. This lack of validation allows for a heap-based buffer overflow that compromises the integrity of the application's memory space.
Technically, the flaw manifests when the vbi_decode function processes incoming teletext streams where every slot is configured with DRCS_MODE_6_5_4. Under these conditions, the convert_drcs routine attempts to write pixel data into a fixed-size array defined as chars[48][60]. The input stream can be crafted such that it exceeds the allocated dimensions of this buffer, leading to an out-of-bounds write operation. Because C and similar systems programming languages do not enforce memory safety at runtime by default, these writes overwrite adjacent memory locations without triggering immediate protection mechanisms in many environments. This corruption can lead to application crashes due to stack or heap mangling, but more critically, it provides a potential vector for arbitrary code execution if the attacker can precisely control the overwritten data and target specific return addresses or function pointers within the process memory layout.
From an operational perspective, this vulnerability poses significant risks to any service that ingests live teletext feeds or processes stored broadcast recordings containing maliciously crafted packets. For applications relying on libzvbi for real-time decoding, such as digital signage systems, broadcasting infrastructure software, or media players with teletext support, a successful exploit could result in denial of service through application termination. In more sophisticated attack scenarios where the underlying operating system lacks advanced memory protection features like ASLR or DEP, an attacker might leverage this buffer overflow to execute arbitrary code on the host system. This would allow for complete compromise of the affected machine, potentially leading to data exfiltration, lateral movement within a network, or establishment of persistent backdoors depending on the privileges under which the vulnerable application is running.
This vulnerability aligns with CWE-120, Buffer Copy without Checking Size of Input, as it involves writing more data into a buffer than it can hold due to insufficient input validation. It also maps to ATT&CK technique T1496, Resource Hijacking, in cases where the crash is used for denial of service, or potentially T1059 if code execution is achieved through exploitation of the memory corruption. Mitigation strategies should prioritize immediate updates to libzvbi version 0.2.46 or later, which includes patches addressing this specific bounds-checking deficiency. In environments where upgrading is not immediately feasible, input sanitization at the application layer can serve as a temporary defense-in-depth measure by filtering out malformed teletext packets before they reach the decoding engine. Additionally, enabling compiler-based security features such as stack protectors and utilizing memory-safe languages for new implementations of similar functionality are recommended long-term architectural improvements to prevent recurrence of such low-level memory errors.