libaribb24 CVE-2026-112281

Requires an application (FFmpeg or VLC) compiled with aribb24 support that actually decodes ARIB STD-B24 caption data, and that caption data must contain a CSI introducer followed by more than 256 parameter bytes to overflow the fixed 256-entry array in decoder_handle_csi(). Limiting factors: the attack vector is local (AV:L) and requires passive user interaction (UI:P) - a victim must open or process the malicious media file or tune the crafted broadcast stream; it is not remotely triggerable without that content-processing step, and exposure is confined to deployments that enable the ARIB caption decoding path (predominantly Japanese broadcast content workflows).

This is a medium-severity, local-vector memory corruption issue, not a drop-everything emergency. The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.9) indicates exploitation requires a local attack vector plus passive user interaction - i.e., a victim must open or process attacker-supplied content - rather than remote, unauthenticated triggering. No EPSS score, no CISA KEV listing, and no explicitly flagged POC were provided in the input, so there is no signal of active or probable widespread exploitation; this is 'no public exploit identified at time of analysis' per available data, though a detailed public technical write-up (hackmd) exists that documents the OOB-write mechanics and would lower the bar for exploit development. The impact signals conflict in a telling way: VA:H (availability) reflects the confirmed crash of FFmpeg/VLC, while VI:L (low integrity) and the description's 'corrupt the return address' language hint at possible control-flow hijack / RCE that is NOT established as reliably achievable - so treat code execution as plausible-but-unproven and the realistic impact as denial of service. Net: a real but bounded issue, prioritized where media/broadcast caption processing with aribb24 is actually in use, not a broad internet-facing priority.

An attacker crafts a media file or broadcast stream embedding an ARIB caption statement with a CSI (Control Sequence Introducer) followed by more than 256 parameter bytes, then induces a victim to open it in FFmpeg or VLC built with aribb24 support. The decoder_handle_csi() routine writes past the fixed 256-entry stack array, crashing the application and potentially corrupting the saved return address. No public exploit code is identified in the provided data, though a detailed technical write-up of the overflow is publicly available.