libdvdnav CVE-2026-112057

Exploitation requires the attacker to supply a crafted DVD or disc image in which the VMGI title's vts_ttn value is larger than the number of part-of-title entries in the corresponding title set, and the victim must open that media in a libdvdnav-based application that enumerates chapters (the dvdnav_describe_title_chapters code path). Limiting factors: the attack vector is local (AV:L) and requires victim interaction (UI:P) to load the malicious disc, there is no remote or unauthenticated-over-network exposure, and the only outcome is an application crash - no code execution, data disclosure, or integrity impact. The vulnerable chapter-enumeration path must actually be invoked for the crash to occur.

This is a moderate, low-priority availability issue rather than a high-impact threat. The CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:P/VC:N/VI:N/VA:H) tells a consistent story: the attack is local (the attacker must get a crafted DVD or disc image in front of a victim), requires passive user interaction (opening/playing the media), needs no privileges, and produces only an availability impact (VA:H) - i.e. an application crash - with no confidentiality or integrity impact despite being an out-of-bounds read. No EPSS score, KEV listing, or declared POC flag was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the signals do not conflict, they simply all point to limited real-world urgency. The practical ceiling of this bug is a denial of service against a media player enumerating chapters, and reaching it requires social-engineering a user into opening attacker-supplied disc content, which sharply constrains scalability. Note the stated score of 6.8 appears to be a CVSS 4.0 value, not 3.1 - confirm which scoring system a given feed is reporting before comparing against other CVEs.

An attacker crafts a malicious DVD image whose VMGI title declares a vts_ttn value larger than the number of part-of-title entries in the title set. When a victim opens this disc or image in a libdvdnav-backed media player and the application enumerates chapters, dvdnav_describe_title_chapters reads past the end of the part-of-title array, crashing the player. No public exploit was identified in the provided data, and exploitation is limited to a denial of service.