Libzvbi
Monthly
Memory corruption in libzvbi through 0.2.45 can occur when a victim application decodes an attacker-supplied Teletext stream containing X/28/3 DRCS packets with unvalidated pixel-mode values, driving an out-of-bounds write in convert_drcs. Exploitation requires local decoding of the malicious stream and passive user interaction (opening or processing the stream/capture), and publicly available exploit code exists; there is no confirmed active exploitation. The out-of-bounds write (CWE-787) crashes the application and may corrupt memory, making this a moderate-severity, low-urgency issue rather than a top priority.
Memory corruption in libzvbi through 0.2.45 can occur when a victim application decodes an attacker-supplied Teletext stream containing X/28/3 DRCS packets with unvalidated pixel-mode values, driving an out-of-bounds write in convert_drcs. Exploitation requires local decoding of the malicious stream and passive user interaction (opening or processing the stream/capture), and publicly available exploit code exists; there is no confirmed active exploitation. The out-of-bounds write (CWE-787) crashes the application and may corrupt memory, making this a moderate-severity, low-urgency issue rather than a top priority.