VideoLAN libbluray CVE-2026-112282

Exploitation requires the victim to open attacker-supplied Blu-ray content containing a crafted ClipInfo (.clpi) file placed in the BDMV/CLIPINF directory, where num_ep_fine is set to zero while ref_ep_fine_id is left unclamped; the out-of-bounds read is triggered specifically when the application performs a seek operation that accesses the EP-map fine table. Limiting factors that reduce real-world risk: the attack vector is LOCAL (the malicious file must reach the victim's filesystem - no network exploitation), it requires user interaction (opening the media and initiating a seek), and the impact is confined to crashing the application (availability only) with no code execution or data disclosure. Affected scope is VideoLAN libbluray through version 1.5.1 and any media player embedding it.

This is a medium-severity denial-of-service issue, not a high-priority emergency. The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 and tells a consistent story: a LOCAL attack vector requiring passive user interaction (the victim must open attacker-supplied Blu-ray content), with impact limited strictly to availability (VA:H) and no confidentiality or integrity impact (VC:N/VI:N). Although PR:N marks it unauthenticated, the AV:L/UI:P combination means this cannot be exploited remotely without network interaction - an attacker must get a crafted .clpi file onto the victim's system and have the victim play/seek the disc image. No EPSS score, CISA KEV listing, or confirmed public exploit code was provided in the input, so there is no signal of active or probable exploitation. The 'Information Disclosure' tag conflicts with the CVSS vector's VC:N (no confidentiality impact), and the 'Buffer Overflow' tag is imprecise for a CWE-125 out-of-bounds READ whose only realized effect is a crash - treat the realistic impact as DoS only. Bottom line: a legitimate bug worth patching in the normal cycle, but low real-world urgency given local vector, required user interaction, and availability-only impact.

An attacker crafts a malicious Blu-ray directory structure and delivers it to a victim (e.g., a downloaded disc image, USB media, or ripped folder) with a .clpi file in BDMV/CLIPINF whose EP-map fine table is empty (num_ep_fine=0) but carries an unclamped ref_ep_fine_id. When the victim opens the content in a libbluray-backed player and performs a seek, clpi_access_point() reads out of bounds and the application crashes. No public exploit code was identified in the input, though a technical write-up describing the flaw exists.