CVE-2026-112282 in libbluray
Summary
by MITRE • 10/19/2026
VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num_ep_fine set to zero and an unclamped ref_ep_fine_id, triggering reads during seeking for denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within VideoLAN libbluray versions up to 1.5.1 represents a critical memory safety flaw located in the clpi_access_point function. This component is responsible for parsing ClipInfo files, which are essential metadata structures used by Blu-ray players and related media software to manage playback points and navigation data. The specific technical defect arises when the parser encounters an EP-map fine table that has been manipulated such that the num_ep_fine field is set to zero while simultaneously containing an unclamped ref_ep_fine_id value. In a properly formed ClipInfo file, these fields are strictly validated against each other to ensure memory access remains within allocated bounds. However, in this vulnerable implementation, the absence of adequate boundary checks allows the application to proceed with accessing array elements based on invalid indices derived from the malformed input data.
From an operational perspective, this flaw leads directly to a denial of service condition through application crashes. When a user or automated system processes a maliciously crafted .clpi file placed in the BDMV/CLIPINF directory structure, the libbluray library attempts to seek using the invalid reference identifier. Because the index is not clamped and the table size is effectively zeroed out, the memory read operation exceeds the allocated buffer boundaries. This results in an out-of-bounds read, which typically triggers a segmentation fault or similar fatal error on most operating systems, causing the media player or application utilizing libbluray to terminate unexpectedly. While primarily impacting availability rather than confidentiality or integrity at this stage, such crashes can disrupt user workflows and potentially serve as a vector for further exploitation if combined with other vulnerabilities in the host environment.
This vulnerability is classified under CWE-125, which denotes Out-of-bounds Read, indicating that software reads data past the end of a buffer. In terms of attack vectors, this aligns with ATT&CK technique T1496, specifically related to Resource Hijacking via Denial of Service, as it consumes system resources and disrupts service availability through application instability. The root cause lies in insufficient input validation during the parsing phase of external media files, highlighting a common weakness in multimedia libraries where complex binary formats are processed without rigorous bounds checking for every field interaction.
To mitigate this risk, organizations relying on libbluray should immediately update to version 1.5.2 or later, which includes patches that enforce strict validation of EP-map fine table parameters before any memory access occurs. Developers integrating this library into custom applications should also implement defensive programming practices by validating all external inputs and ensuring that index calculations are clamped against known buffer sizes. Additionally, deploying sandboxing mechanisms for media processing services can limit the impact of such crashes, preventing them from affecting critical system components or other user processes. Regular security audits focusing on memory safety in C-based libraries remain essential to prevent similar out-of-bounds access issues in future updates.