libzvbi EUVD-2026-101127

Exploitation requires that a victim application built on libzvbi (through 0.2.45) decode an attacker-supplied Teletext stream through the vbi_decode path, and that the stream contain X/28/3 DRCS packets with pixel-mode slots set to the unvalidated DRCS_MODE_6_5_4 value, which drives convert_drcs to write past chars[48][60]. The key LIMITING factors are: attack vector is LOCAL (the malicious Teletext data must be fed to the local decoder, not sent over a network service), and passive user interaction is required (UI:P) - the victim must open or process the attacker-controlled stream/capture. No special non-default configuration is otherwise required beyond use of the Teletext/DRCS decoding functionality, and no authentication is needed (PR:N).

This is a moderate-severity, low-urgency issue rather than a top priority. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H) scores 6.9 and is internally consistent with the description: exploitation is LOCAL (the attacker must get a crafted Teletext stream in front of a victim's decoder), requires passive user interaction (UI:P), and the dominant impact is availability (VA:H, a crash) with only limited integrity impact (VI:L) and no confidentiality impact (VC:N). Publicly available exploit code exists (referenced HackMD write-up and VulnCheck advisory), which raises the practical likelihood of reproduction, but there is NO CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. The signals are therefore aligned and point to a crash/DoS-class memory-corruption bug in a niche media library, not a remotely weaponizable network flaw. Note: although PR:N makes this 'unauthenticated,' the AV:L / UI:P combination means an attacker cannot reach the code without a victim choosing to decode attacker-controlled Teletext data - the 'network vector' intuition does NOT apply here. CWE-787 (out-of-bounds write) plus a known POC means code-execution potential cannot be fully excluded, but the vendor/CVSS impact framing treats the realistic outcome as a crash.

An attacker crafts a malicious Teletext stream (or a media file/capture containing X/28/3 DRCS packets) with every slot set to DRCS_MODE_6_5_4 and delivers it to a victim who decodes it with an application built on libzvbi. When the victim's application calls vbi_decode, convert_drcs writes past the bounds of the chars[48][60] buffer, corrupting memory and crashing the process. A public exploit/write-up already demonstrates the out-of-bounds write.