EUVD-2026-104290
GHSA-2xfh-28f7-pm5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft .clpi file with huge num_point
-
DeliveryDeliver on disc, image, or directory
-
ExploitVictim opens media in libbluray-based player
-
ExecutionUnbounded allocation in _parse_extent_start_points()
-
ImpactMemory and CPU exhausted, application denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | Exploitation requires the attacker to supply a crafted .clpi file (with an oversized num_point field) via a Blu-ray disc, disc image, or directory, and the victim must open or play that media in an application linked against libbluray version 1.5.1 or earlier so that the Blu-ray clip-info parsing path (_parse_extent_start_points() in clpi_parse.c) is reached. Limiting factors: there is no remote/network trigger (AV:L), the victim must take an action to load the malicious media (UI:P), and the impact is confined to availability - an application crash or memory/CPU exhaustion - with no data exposure or code execution. Risk is therefore concentrated in workflows that automatically ingest untrusted Blu-ray structures. |
| Impact | The input CVSS 4.0 score of 6.8 (medium) is consistent with the vulnerability's nature: the vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N shows a local attack vector requiring passive user interaction, no privileges, and an availability-only impact (VA:H) with zero confidentiality or integrity effect. This is a denial-of-service memory/CPU exhaustion bug (CWE-789), not a code-execution flaw, so raw severity overstates operational urgency. No CISA KEV listing is present, no EPSS probability was supplied, and no public exploit code is flagged in the input, so there is no public exploit identified at time of analysis. The AV:L vector is the dominant risk-limiter: an attacker cannot trigger this remotely over a network - they must get a victim to open or mount a crafted .clpi-bearing disc, image, or directory in an application using libbluray. Net real-world risk is modest and opportunistic rather than widespread; it matters most for automated or unattended media-processing pipelines that ingest untrusted Blu-ray structures. One data caveat: the referenced hackmd write-up is titled 'libbluray-clpi-ep-map-oob-read' (out-of-bounds read), while the NVD description and CWE-789 frame this strictly as uncontrolled allocation/DoS - verify whether a related memory-safety issue is in scope. |
| Exploit ScenarioDerived | An attacker crafts a malicious .clpi clip-info file with an enormous num_point value and distributes it on a Blu-ray disc, ISO image, or directory structure. When a victim opens the media in a player built on libbluray (e.g., VLC/Kodi/MPV), _parse_extent_start_points() trusts num_point without bounds checking and attempts a massive allocation, exhausting memory and CPU and crashing or hanging the application. No public exploit code is identified, though a technical write-up describing the parsing flaw exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
An uncontrolled memory allocation in VideoLAN libbluray through 1.5.1 lets a crafted Blu-ray clip-information (.clpi) file drive memory and CPU exhaustion, crashing or hanging any application linked against the library that opens the media. The flaw sits in _parse_extent_start_points() in clpi_parse.c, which allocates based on the attacker-controlled num_point field without validating it against the actual file size. Exploitation is local and requires the victim to load the malicious disc, image, or directory (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, availability-only), so impact is confined to denial of service with no data exposure or code execution; no public exploit code was identified at time of analysis, though a public technical writeup describing the parsing flaw exists.
RemediationAI
No vendor-released patch identified at time of analysis: the supplied references point to the vulnerable 1.5.1 source file and to third-party advisories rather than a fixed release, so confirm whether an updated libbluray build is available from VideoLAN and, if so, upgrade the library and every linked application (VLC, Kodi, mpv) to that version and rebuild or repackage the binaries against it. Until a fix is available, the most effective control is to prevent untrusted .clpi content from reaching the parser: refuse to open Blu-ray discs, ISO images, or BDMV directory trees from untrusted sources, and disable Blu-ray navigation in players that expose the toggle (in VLC this means not enabling Blu-ray menu/navigation support for untrusted media) - the trade-off is loss of Blu-ray playback functionality. Where Blu-ray handling cannot be disabled, confine the player to a memory- and CPU-capped sandbox (cgroup memory.max/limits, ulimit -v, container resource limits) so an oversized allocation fails fast instead of exhausting the host; the trade-off is that large legitimate titles may fail to play under tight caps. Automated ingestion pipelines that scan or index untrusted disc images should run libbluray-based parsing in an isolated, resource-limited worker and treat .clpi parse failures as hostile input rather than retrying. Monitor https://www.vulncheck.com/advisories/libbluray-through-1.5.1-uncontrolled-memory-allocation-via-parse-extent-start-points for a fixed version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libbluray is the open-source Blu-ray disc navigation library used by VLC, Kodi, mpv and other media players to parse BDMV structures. A .clpi file in the CLIPINF directory describes a clip and contains an EP_map (extent start points) table whose entry count is advertised by the num_point field. _parse_extent_start_points() in src/libbluray/bdnav/clpi_parse.c reads num_point from the file and uses it to size an allocation and drive a parsing loop, trusting the declared count rather than cross-checking it against the remaining file length. This is CWE-789 (uncontrolled memory allocation): with a small malformed file declaring a huge num_point, the process attempts an enormous allocation and/or burns CPU iterating entries, producing an out-of-memory condition or prolonged processing and ultimately a denial of service in the host application. The weakness is reachable purely through the disc-image parsing path, so any downstream application that auto-loads untrusted Blu-ray content inherits the exposure.
Know when Videolan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Attacker must deliver a local crafted file and the victim must open it, so AV:L and UI:R; no auth needed (PR:N); DoS yields A:H with no C/I impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code
Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of ser
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allo
Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in fun
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an inpu
In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in th
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arb
VideoLAN VLC media player before 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service. R
The picture_Release function in misc/picture.c in VideoLAN VLC media player 2.1.5 allows remote attackers to execute arb
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer ove
plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a d
The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer
Exploit-DB