CVE-2026-112283Medium· 5.5▾ TwilightPoC availableVideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 30.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
Last analysed / modified upstream
Exploit / PoC code exists
0.1% → 0.2%
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.
libbluray <= 1.5.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112282Medium· 5.5VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point
CVE-2026-112057Medium· 5.5libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
CVE-2026-112058Medium· 5.5libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT
CVE-2026-115724Low· 2.9VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider
CVE-2026-112399High· 8.7Pillow: APNG background disposal allocates full canvas before decompression bomb check
CVE-2026-112048Medium· 6.1libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count