EUVD-2026-104301
GHSA-qvww-h55c-pg37
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttach malicious EDID source or supply crafted file
-
ExploitApplication parses DisplayID v2 section
-
ExecutionOversized data-block length over-advances parse cursor
-
ImpactHeap out-of-bounds read crashes application
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target application must use libdisplay-info 0.4.0 and reach the DisplayID v2 section parser (displayid2.c) on an EDID that contains a data block with an oversized length field. The malicious EDID must be delivered via a locally attached source - a rogue monitor, KVM, or capture device - or as a crafted EDID file processed by the application, so exploitation requires local access plus passive user interaction (UI:P, e.g. plugging in the device or opening the file). Limiting factors: there is no remote/network path, no authentication bypass or code execution, and the only outcome is a crash; systems not parsing attacker-controlled EDID are unaffected. |
| Impact | This is a medium-severity denial-of-service issue, not a critical priority. The vendor CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:P, VC:N/VI:N/VA:H) is internally consistent with the description: impact is limited to availability (an application/compositor crash) with no confidentiality or integrity loss, despite the CWE-125 out-of-bounds read. Attack vector is Local - exploitation requires either physically attaching a malicious EDID source (monitor, KVM, capture device) or getting a crafted EDID file parsed - and requires passive user interaction (UI:P), both of which materially limit real-world weaponization compared with a remote network flaw. No EPSS score is provided and there is no CISA KEV listing, so there is no evidence of active or widespread exploitation; the reporting is from VulnCheck with a public technical writeup, indicating research-grade disclosure rather than observed attacks. Net: real but low-urgency - patch during normal cycles; mass remote exploitation is not a realistic threat given AV:L and the availability-only impact. |
| Exploit ScenarioDerived | An attacker connects a malicious monitor, KVM, or USB capture device (or delivers a crafted EDID file) to a system running software built on libdisplay-info 0.4.0, such as a Wayland compositor. When the DisplayID v2 section parser in displayid2.c reads an oversized data-block length, it advances the cursor past the EDID buffer, triggering a heap out-of-bounds read that crashes the application. A detailed technical writeup exists, but no confirmed weaponized public exploit or active exploitation is documented. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Heap out-of-bounds read in libdisplay-info 0.4.0's DisplayID v2 parser lets a crafted EDID over-advance the parse cursor and crash the consuming application. The vulnerable path is reachable when an application parses attacker-controlled EDID data supplied through a malicious monitor, KVM, capture device, or crafted file, requiring local access and passive user interaction. This is a medium-severity denial-of-service issue, not a critical priority, with no code execution or confidentiality impact and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis. Until an upstream fix is available in the GitLab repository, treat EDID input as untrusted: before calling libdisplay-info, validate DisplayID v2 data block lengths and reject any block whose length exceeds the remaining buffer, accepting that strict validation may reject malformed or non-compliant displays. Applications that process EDID files should run the parser in a low-privilege or sandboxed helper so an out-of-bounds read only crashes the helper, at the cost of additional process isolation complexity. Avoid automatic parsing of EDID from untrusted monitors, KVMs, or capture devices, or disable such hot-plug parsing, understanding that this may reduce display metadata availability and hotplug convenience. Monitor the upstream repository and VulnCheck advisory for a fixed release before deploying an updated version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libdisplay-info is a library used to parse EDID and DisplayID metadata from displays; DisplayID v2 is a VESA display-identification format that can carry structured data blocks with length fields. In displayid2.c, the parser trusts data block lengths while advancing its cursor, so an oversized length can move the parse position past the allocated EDID buffer and trigger a heap out-of-bounds read (CWE-125). The supplied CVSS 4.0 vector is local (AV:L), user-interaction dependent (UI:P), unauthenticated (PR:N), and impacts only availability (VA:H) with no confidentiality or integrity effect. The CPE entry cpe:2.3:a:emersion:libdisplay-info:*:*:*:*:*:*:*:* identifies the emersion libdisplay-info product; the described flaw is specifically in version 0.4.0's DisplayID v2 section parser.
Know when Libdisplay Info gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Exploitation needs a locally supplied EDID (AV:L) and the victim to attach the device or open the file (UI:R); impact is an application/compositor crash only, so C:N/I:N and A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB