CVE-2026-112057 in libdvdnav
Summary
by MITRE • 10/18/2026
libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vts_ttn than the title set's entries to crash applications enumerating chapters.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in libdvdnav versions prior to 7.0.0 represents a critical heap-based out-of-bounds read flaw located within the dvdnav_describe_title_chapters function. This specific component is responsible for parsing and describing chapter structures on DVD media, a process that relies heavily on accurate metadata extraction from the disc's Video Manager Information (VMGI) structure. The core technical deficiency arises when the library processes an oversized vts_ttn value supplied by the attacker. In standard operation, this value indicates which title set to access within the DVD structure. However, due to insufficient validation of input bounds relative to the allocated memory structures, the function fails to verify that the requested index exists within the actual array of available titles defined in the disc's metadata.
When an application utilizes libdvdnav to enumerate chapters on a maliciously crafted DVD or disk image, it may encounter a scenario where the declared vts_ttn value exceeds the number of entries present in the title set's internal arrays. Instead of triggering a safe error condition or rejecting the invalid input, the vulnerable code proceeds to access memory locations beyond the allocated boundaries of the part-of-title array. This results in reading arbitrary heap data that does not belong to the intended structure. While this specific vulnerability is classified as an out-of-bounds read rather than a write, it still poses significant risks including information disclosure and potential denial of service conditions depending on how the accessed memory contents are interpreted by the calling application.
From an operational perspective, this flaw primarily impacts applications that parse DVD media for navigation purposes, such as video players, disc ripping tools, or multimedia frameworks integrated into larger software suites. An attacker can exploit this weakness by distributing a specially crafted ISO image or physical disc containing malformed VMGI data. When a victim opens such content using a vulnerable version of libdvdnav, the application may crash due to accessing invalid memory addresses, leading to a denial of service against the end user. In more complex scenarios where the out-of-bounds read exposes sensitive heap metadata, there is also a potential for information leakage that could aid in further exploitation attempts, although the primary immediate impact remains stability and availability disruption.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-125, which describes Out-of-Bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. Furthermore, from a tactical standpoint related to the MITRE ATT&CK framework, this flaw facilitates reconnaissance and potentially denial of service activities by allowing an attacker to disrupt application functionality through malformed input rather than executing arbitrary code directly. The lack of proper boundary checks during the parsing phase is indicative of CWE-20 Improper Input Validation, highlighting the need for rigorous sanitization of all external inputs before they are used as array indices or memory offsets.
To mitigate this risk, organizations and developers must upgrade libdvdnav to version 7.0.0 or later, where these boundary checks have been implemented to ensure that vts_ttn values do not exceed the actual size of the title set arrays. For applications unable to update immediately, implementing input validation at the application layer is recommended as a temporary workaround. This involves verifying that any DVD metadata processed by libdvdnav conforms to expected structural constraints before passing it to the library functions. Additionally, enabling robust crash reporting and memory protection mechanisms such as Address Sanitizer during development can help identify similar issues in other parts of the codebase. Regular security audits focusing on media parsing libraries are essential to prevent recurrence of such input validation failures across multimedia software ecosystems.