libaribcaption EUVD-2026-104289

Exploitation requires the victim to decode an attacker-supplied ARIB STD-B24 caption stream that designates the Latin special character set via the escape sequence ESC 28 4C (0x1B 0x28 0x4C) followed by a byte in the range 0x6F-0x7E, which drives DecoderImpl::HandleGLGR() to index past the 78-entry kLatinSpecialTable. Limiting factors: the attack is local (AV:L) - the attacker cannot trigger it over the network but must get malicious caption content in front of a victim's decoder - and it requires passive user interaction (UI:P), i.e., the victim must play/process the crafted media. Only libaribcaption versions 1.1.0 through 1.1.2 are affected; the issue is fixed in commit 9917cb3. No authentication is required (PR:N), but there is no default remote exposure.

This is a genuinely low-to-moderate priority issue despite the 'Information Disclosure' framing. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 4.8) describes a local, low-complexity, unauthenticated flaw that requires passive user interaction (a victim decoding attacker-supplied caption data). There is a notable internal conflict: the description states the bug can 'leak adjacent read-only data,' yet the input CVSS sets VC:N (no confidentiality impact) and scores only VA:L (low availability) - so the vendor-supplied vector treats this primarily as a crash/DoS rather than a meaningful data-leak primitive, likely because the adjacent memory is static read-only constant data rather than secrets. No EPSS score and no KEV status were provided; exploitation status is 'no public exploit identified at time of analysis,' though a detailed technical write-up with exact trigger bytes exists on HackMD, effectively lowering the bar to reproduce. Because the attack vector is local and demands that a victim process a crafted ARIB caption stream, real-world exploitability is constrained to media-processing contexts (e.g., a media player ingesting a malicious stream/file). Verdict: a real but low-urgency bug - patch during normal maintenance; it is neither a wormable nor a remotely-triggerable high-severity issue.

An attacker crafts a malicious ARIB STD-B24 caption stream (embedded in a media file or broadcast-style stream) that designates the Latin special set using the escape sequence ESC 28 4C and then supplies bytes in the 0x6F-0x7E range. When a victim plays or decodes this content with libaribcaption 1.1.0-1.1.2, DecoderImpl::HandleGLGR() indexes past the 78-entry kLatinSpecialTable, reading out-of-bounds read-only memory that may crash the decoder or surface adjacent constant data in rendered output. No weaponized exploit is published, but a HackMD write-up documents the exact trigger bytes, making reproduction straightforward.