CVE-2026-112058 in libdvdnav
Summary
by MITRE • 10/18/2026
VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in VideoLAN libdvdnav versions through 7.0.0 represents a critical memory safety flaw rooted in insufficient input validation within the set_PTT function. This component is responsible for managing Program Chain (PGC) operations during DVD playback, specifically handling Jump Title Table commands that direct the player to specific titles on a disc. The core technical deficiency lies in the fact that the bounds checking for title numbers relies exclusively on an assert statement rather than robust conditional logic suitable for production environments. In many build configurations and deployment scenarios, assertions are compiled out or do not trigger exceptions but merely halt execution via abort signals when conditions fail. Consequently, when a crafted DVD image or disc file contains a First Play program chain that issues a JumpTT command with title 0 or an oversized number exceeding the allocated heap memory for the title table, the application proceeds to access invalid memory addresses without proper safeguards.
This out-of-bounds read vulnerability allows attackers to cause denial of service conditions by crashing the media player application. By supplying maliciously crafted disc images that exploit this logic error, remote actors can trigger a segmentation fault or similar fatal error in the victim's software environment. The impact is primarily confined to availability as it results in immediate termination of the process rather than arbitrary code execution, although such crashes can be leveraged for further exploitation if combined with other vulnerabilities or specific memory corruption states. The reliance on assert statements for security-critical bounds checking highlights a common development oversight where debugging aids are mistakenly treated as sufficient protection mechanisms against malformed inputs from untrusted sources like optical media files.
From an industry standards perspective, this flaw aligns closely with CWE-125 Out-of-bounds Read and CWE-613 Insufficient Session Expiration or CWE-703 Improper Output Validation depending on the specific context of how the data is processed before reaching the vulnerable function. It also maps to MITRE ATT&CK techniques related to Denial of Service, specifically those involving application crashes through malformed input files. The vulnerability underscores the importance of implementing rigorous boundary checks that are active in all build configurations and do not depend on debug-specific features like assertions for security enforcement.
To mitigate this risk, developers must replace assert-based validation with explicit conditional checks that verify title indices against valid ranges before accessing array elements or heap structures associated with title tables. Input sanitization should be enforced at the earliest possible stage of parsing DVD navigation commands to ensure that only legitimate values are processed by downstream functions like set_PTT. Additionally, enabling Address Sanitizer during testing phases can help identify such memory access violations early in the development lifecycle. Users relying on affected versions should update to patched releases where these validation mechanisms have been hardened to prevent crashes caused by maliciously crafted media files.