Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-112280libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body

Medium 6.1

In plain English

A medium-severity heap buffer overflow in aribb24 from nkoriyama. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.1%top 97.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.

Affected products (as reported)

Vendor	Product	Versions
nkoriyama	aribb24	0 – through 1.0.3

Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

References

https://hackmd.io/@haindpwn/aribb24-caption-data-unit-and-csi-oob-write third-party-advisory
https://github.com/nkoriyama/aribb24/blob/v1.0.3/src/parser.c technical-description
VulnCheck Advisory: libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body third-party-advisory