CVE-2026-112283 in libbluray
Summary
by MITRE • 10/19/2026
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within VideoLAN libbluray versions through 1.5.1 represents a critical uncontrolled memory allocation flaw located in the clpi_parse.c module, specifically within the _parse_extent_start_points function. This component is responsible for parsing Control Information files associated with Blu-ray discs, which contain metadata necessary for playback synchronization and navigation. The core technical deficiency arises from the application's failure to perform bounds checking on the num_point field extracted during the parsing process. Instead of validating that this value falls within a reasonable or expected range relative to available system resources or logical file structure constraints, the software directly trusts the input data provided by the attacker-controlled .clpi file. This lack of validation allows an adversary to inject a maliciously crafted disc image, directory, or physical media containing a num_point field with an excessively large integer value.
When the library processes this malformed input, it attempts to allocate memory based on the unvalidated magnitude of the num_point field without any upper limit checks. Consequently, the application triggers massive heap allocations that far exceed typical operational requirements. This behavior leads directly to resource exhaustion, manifesting as a severe denial of service condition. The system experiences significant degradation in performance due to CPU cycles consumed by the allocation attempts and subsequent memory pressure, potentially causing the media player or any dependent application utilizing libbluray to crash or become unresponsive. In environments where such libraries are used for automated processing or streaming services, this vulnerability can be leveraged to disrupt availability across multiple users if a malicious disc image is distributed through compromised channels.
From a classification perspective, this flaw aligns with CWE-789: Uncontrolled Memory Allocation, as the software allocates memory based on externally influenced input without proper restriction of the amount allocated. Furthermore, in the context of attack tactics and techniques, this vulnerability facilitates an Availability impact consistent with ATT&CK technique T1499: Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion via application layer attacks. The exploitation vector typically involves physical access to media or network delivery of a crafted file that triggers the parsing routine upon playback initiation.
Mitigation strategies for this vulnerability primarily involve upgrading libbluray to version 1.5.2 or later, where developers have implemented proper input validation and bounds checking mechanisms within the _parse_extent_start_points function. For organizations unable to immediately patch their systems, defensive measures include implementing strict file integrity checks before processing Blu-ray content, restricting execution privileges for media players to limit potential system-wide impact, and deploying network-level filtering to block known malicious disc images or suspicious .clpi files from entering trusted environments. Additionally, monitoring for abnormal memory usage spikes in applications utilizing this library can serve as an early detection mechanism for attempted exploitation of this resource exhaustion flaw.