CVE-2026-112284 in libaribcaption
Summary
by MITRE • 10/19/2026
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in libaribcaption versions 1.1.0 through 1.1.2 represents a critical memory safety flaw classified as an out-of-bounds read, specifically falling under CWE-125: Out-of-bounds Read. This defect resides within the DecoderImpl::HandleGLGR function, which is responsible for processing graphic character sets in ARIB STD-B24 caption streams commonly used in Japanese digital broadcasting. The core technical issue arises from a missing upper bound check when accessing the kLatinSpecialTable, an array containing seventy-eight entries that maps specific escape sequences to their corresponding glyph data. When the decoder encounters a sequence designated as ESC 28 4L followed by bytes ranging from hexadecimal 0x6F to 0x7E, it attempts to index into this table without verifying if the provided byte value constitutes a valid offset within the array's defined limits.
From an operational perspective, this lack of validation allows an attacker who can inject or manipulate caption data streams to trigger undefined behavior in the application consuming these captions. Because the read operation extends beyond the allocated memory region of the kLatinSpecialTable, it accesses adjacent memory locations that are not intended for use by this specific lookup table. Depending on the compiler's optimization level and the surrounding memory layout, this out-of-bounds access can result in two primary adverse outcomes: information disclosure or application instability. In cases where the adjacent memory contains sensitive data such as pointers, cryptographic keys, or other internal state variables, an attacker could potentially exfiltrate this information through side-channel effects or by carefully crafting subsequent operations that utilize the leaked values. Alternatively, if the accessed memory is unmapped or protected, the process will encounter a segmentation fault, leading to a denial of service condition where the captioning application crashes unexpectedly.
This vulnerability aligns with ATT&CK technique T1059.007: Command and Scripting Interpreter, specifically in contexts where malicious captions are used as part of a broader attack chain to achieve initial access or persistence, although its direct impact is limited to memory corruption. The exploitation vector typically involves the delivery of a crafted media file or live broadcast stream containing the malformed caption data. Since libaribcaption is often integrated into video players and broadcasting infrastructure software, the blast radius can be significant if these components are used in public-facing applications or critical infrastructure monitoring systems.
To mitigate this vulnerability, developers must immediately update to patched versions of libaribcaption that include bounds checking logic within the HandleGLGR function. The fix should enforce strict validation of input bytes against the known size of the kLatinSpecialTable before performing any array access operations. For organizations unable to patch immediately, implementing a sandboxed environment for processing untrusted caption streams can reduce the risk of exploitation. Additionally, enabling memory protection features such as Address Sanitizer during testing phases and deploying runtime application self-protection mechanisms in production environments can help detect or prevent the consequences of this out-of-bounds read before it leads to data leakage or system compromise.