Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110654libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs

Medium 6.1

In plain English

A medium-severity out-of-bounds write in libzvbi from zapping-vbi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 93.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	zvbi	no fix listed	DEBIAN-CVE-2026-110654
Debian:13	zvbi	no fix listed	DEBIAN-CVE-2026-110654
Debian:14	zvbi	0.2.46-1	DEBIAN-CVE-2026-110654
Ubuntu:26.04:LTS	zvbi	no fix listed	UBUNTU-CVE-2026-110654
Ubuntu:26.10	zvbi	no fix listed	UBUNTU-CVE-2026-110654

Affected products (as reported)

Vendor	Product	Versions
zapping-vbi	libzvbi	0 – through 0.2.45

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

References

https://hackmd.io/@haind-pwn/zvbi-teletext-drcs-mode-oob-write technical-description, exploit
https://github.com/zapping-vbi/zvbi/blob/d3a5ee9f2b047bf16cd1ee5ccf6ec05ee75409d0/src/packet.c#L447 technical-description
https://github.com/zapping-vbi/zvbi product
VulnCheck Advisory: libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs third-party-advisory