Description
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nkoriyama aribb24
Default version status: unaffected
0 to ≤ 1.0.3affected
References
- https://hackmd.io/@haindpwn/aribb24-caption-data-unit-and-csi-oob-write ↗
- https://github.com/nkoriyama/aribb24/blob/v1.0.3/src/decoder.c ↗
- https://www.vulncheck.com/advisories/libaribb24-through-1.0.3-stack-buffer-overflow-via-decoder-handle-csi ↗
- https://hackmd.io/@haindpwn/cve-2026-112280-112281-aribb24-caption-data-unit-and-csi-oob-write ↗