EUVD-2026-103520
GHSA-hq5c-9qf4-9924
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious DVD image with hostile First Play PGC
-
DeliveryDeliver disc/image to victim
-
ExploitVictim opens media in libdvdnav player
-
ExecutionJumpTT with invalid title triggers OOB read in set_PTT
-
ImpactApplication crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to locally open an attacker-crafted DVD or disc image whose First Play program chain issues a JumpTT navigation command with an invalid title number (title 0 or a value larger than the title table). Exploitation is gated by passive user interaction (UI:P) - the user must play the malicious media in an application built on libdvdnav through 7.0.0 - and by local delivery (AV:L); there is no network-reachable attack surface. The faulty input validation is in the default navigation path (the bounds check is an assert rather than a runtime guard), so no special non-default configuration is needed beyond normal DVD playback. |
| Impact | This is a moderate-severity denial-of-service issue, not a high-priority remote threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) correctly characterizes it: exploitation is LOCAL and requires the victim to open attacker-supplied media (UI:P passive interaction), and the only impact is availability (VA:H) - an application crash - with zero confidentiality or integrity impact (VC:N/VI:N). The description confirms this: an out-of-bounds read past the heap title table caused by an assert-only bounds check on the JumpTT title number, which crashes the player rather than leaking data or executing code. No EPSS score, KEV listing, or POC/exploit-code availability was supplied in the input, so there is no public exploit identified at time of analysis. Note a conflict with the input tags: the 'Information Disclosure' tag contradicts the CVSS impact metrics (VC:N) and the described behavior (a crash, not a read of attacker-recoverable data) - treat the crash/DoS framing as authoritative. Overall this is a 'fix during normal patch cycle' issue: real but requiring social engineering (tricking a user into playing a malicious disc/image) and yielding only a crash. |
| Exploit ScenarioDerived | An attacker crafts a DVD or disc image whose First Play program chain issues a JumpTT navigation command with title number 0 or an oversized value. When a victim opens this media in a player using libdvdnav (through 7.0.0), set_PTT reads past the heap title table and the application crashes. No public exploit code was provided, and exploitation requires the victim to locally load the malicious media (UI:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Opening a crafted DVD or disc image in a media player built on VideoLAN libdvdnav through 7.0.0 can crash the application through an out-of-bounds read in DVD navigation handling. The fault is triggered when the disc's First Play program chain issues a JumpTT command with title 0 or an oversized title number, causing the library to index past its heap title table because validation relies on an assert rather than a runtime bounds check. Exploitation requires local delivery and user playback of the malicious media, no public exploit was identified at time of analysis, and the assessed impact is denial of service only.
RemediationAI
No vendor-released patch identified at time of analysis; the supplied reference points to the vulnerable libdvdnav 7.0.0 source rather than a fixed release. Until a patched libdvdnav version is published, avoid opening untrusted DVD images or ISO files in players linked against libdvdnav through 7.0.0 and restrict such playback to trusted media; this removes the attack vector but reduces functionality for untrusted content. Maintainers can add a runtime bounds check in set_PTT that rejects title 0 and any index beyond the title table before dereferencing it, trading acceptance of malformed navigation commands for crash prevention. Running the player in a sandboxed or isolated process can contain the availability impact of a crash, though it does not fix the underlying out-of-bounds read. Monitor the VulnCheck advisory at https://www.vulncheck.com/advisories/libdvdnav-through-7.0.0-out-of-bounds-read-via-set-ptt-jumptt and the source reference at https://code.videolan.org/videolan/libdvdnav/-/blob/7.0.0/src/vm/getset.c#L51 for updated guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libdvdnav implements DVD navigation, including program chain and title-table handling used by media players for disc playback. The CWE-125 out-of-bounds read is in set_PTT in src/vm/getset.c, where an invalid JumpTT title number is checked only by an assert; title 0 or a value beyond the heap title table can then be used to read past the allocation. This is not a network-reachable flaw: the attack surface is local media playback, and the supplied CPE cpe:2.3:a:videolan:libdvdnav:*:*:*:*:*:*:*:* identifies the libdvdnav package while the advisory scopes affected releases through 7.0.0. The assessed consequence is availability impact from a crash, with no confidentiality or integrity impact under the independent assessment.
Know when Libdvdnav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local crafted-media vector (AV:L) requiring the victim to open the disc (UI:R); no privileges needed (PR:N); impact is crash-only, so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB