libaribb24 CVE-2026-112280

Exploitation requires the target application (FFmpeg or VLC, or any consumer linked against libaribb24 ≤1.0.3) to parse a crafted caption PES packet whose caption data unit is oversized, routed through arib_parse_pes() in src/parser.c. It requires passive user interaction (UI:P) - the victim must open/play the malicious media file or tune/process the crafted broadcast stream; it is not self-triggering. Limiting factors that reduce real-world risk: the vulnerable code path is only reached when ARIB STD-B24 caption decoding is actually invoked (predominantly Japanese digital-broadcast content), so systems that never decode ARIB captions are not exposed; exploitation is local/file-driven (AV:L) rather than remote-unauthenticated, and the confirmed outcome is a crash (availability) with only limited integrity impact - reliable code execution is described as a possibility, not demonstrated.

This is a medium-severity (CVSS 4.0 base 6.9) memory-safety flaw whose real-world priority is modest. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H) describes a locally-reachable, low-complexity bug that requires passive user interaction (opening or playing a malicious file/stream) and whose dominant impact is availability (VA:H - the crash of FFmpeg/VLC) with only limited integrity impact (VI:L) and no confidentiality impact (VC:N). No EPSS score was supplied in the input, so exploitation probability cannot be quantified - treat it as unknown rather than low. The CVE is NOT in CISA KEV and there is no public exploit identified at time of analysis, though a detailed third-party technical write-up exists (hackmd.io) describing the caption-data-unit and CSI out-of-bounds write, which lowers the barrier to developing a PoC. Signals are internally consistent: a file/stream-parsing crash primitive with theoretical heap-corruption potential, disclosed by a reputable source (VulnCheck), but with no evidence of active or widespread exploitation. One ambiguity worth flagging: the description mentions a 'broadcast stream' as a delivery path, which could arguably support a network vector, yet the assigned vector is AV:L (file/stream must be processed locally by the player) - verify the delivery assumption against the vendor/VulnCheck advisory. Overall this is a legitimate but lower-tier issue: patch in normal cycles, not an emergency, for the small population of systems that actually decode ARIB captions.

An attacker crafts a media file (or broadcast stream) containing an ARIB caption PES packet with an oversized caption data unit and delivers it to a victim who plays it in FFmpeg or VLC built with libaribb24. When arib_parse_pes() in src/parser.c processes the malformed data unit, a heap-based buffer overflow (CWE-122) corrupts heap memory, reliably crashing the player (denial of service) and possibly enabling further memory corruption. No public weaponized exploit is identified, but a public technical write-up documenting the out-of-bounds write exists.