CVE-2026-112281 in aribb24
Summary
by MITRE • 10/19/2026
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within libaribb24, specifically affecting versions through 1.0.3, represents a critical stack-based buffer overflow located in the decoder_handle_csi function found in src/decoder.c. This component is responsible for processing Channel Service Information (CSI) data, which is integral to the decoding of ARIB STD-B24 captioning streams commonly used in Japanese digital broadcasting and media files. The core technical flaw stems from an insufficient validation mechanism when handling CSI parameter bytes. Specifically, the function allocates a fixed-size buffer on the stack with a capacity of only 256 entries but fails to enforce this limit during the parsing process. Consequently, if an attacker supplies unbounded or excessively long CSI parameter sequences within a media file or broadcast stream, the decoder will write data beyond the boundaries of this allocated array. This lack of bounds checking allows for arbitrary memory writes on the stack, which is a classic manifestation of CWE-121: Stack-based Buffer Overflow.
The operational impact of this vulnerability is severe due to its potential for remote code execution and service disruption. By embedding a maliciously crafted caption statement that includes a CSI introducer followed by more than 256 parameter bytes, an attacker can exploit the overflow to overwrite adjacent stack memory. This typically involves corrupting critical control data such as the return address or frame pointer. In practical scenarios involving popular multimedia frameworks like FFmpeg and VLC media player, which utilize libaribb24 for caption decoding, this corruption leads directly to application crashes, resulting in a denial of service against users consuming the malicious content. More critically, if an attacker can precisely control the overwritten data, they may achieve arbitrary code execution by redirecting program flow to shellcode or existing library functions embedded within the process memory space. This aligns with ATT&CK technique T1203: Exploitation for Client Execution, where attackers leverage vulnerabilities in client-side applications to gain initial access or persistence on a target system.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The primary solution is the urgent upgrade of libaribb24 to version 1.0.3 or later, as this release includes patches that implement proper bounds checking for CSI parameter arrays. For environments where upgrading the library is not immediately feasible, deploying input validation filters at the application layer can help block malformed caption data before it reaches the decoder. Additionally, security teams should enable stack protection mechanisms such as Stack Canaries and Address Space Layout Randomization (ASLR) to mitigate exploitation attempts by making memory layout unpredictable or detecting overwrites early. Regular auditing of third-party dependencies for similar buffer handling flaws is also recommended to prevent recurrence of CWE-120: Buffer Copy without Checking Size of Input in other components of the media processing pipeline.