CVE-2026-112284
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpec
CVSS
3.3
Low
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Oct 19, 2026 · Last modified: Oct 19, 2026 · CWE-125
Not enough EPSS history yet.
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.
- github.comhttps://github.com/xqq/libaribcaption/blob/v1.1.2/src/decoder/b24_conv_tables.hpp
- github.comhttps://github.com/xqq/libaribcaption/blob/v1.1.2/src/decoder/decoder_impl.cpp
- github.comhttps://github.com/xqq/libaribcaption/commit/9917cb311c93d884cb820d122911a211042da26c
- hackmd.iohttps://hackmd.io/@haindpwn/libaribcaption-latin-special-table-oob-read
- www.vulncheck.comhttps://www.vulncheck.com/advisories/libaribcaption-1.1.0-through-1.1.2-out-of-bounds-read-via-decoderimpl-handleglgr
- hackmd.iohttps://hackmd.io/@haindpwn/libaribcaption-latin-special-table-oob-read
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-101201——
——0A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.3hCVE-2026-1093959.1 CRI—
——0Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.11hCVE-2026-112896——
——0Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.14hCVE-2026-1122607.1 HIG—
——0A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.14hCVE-2026-126693.1 LOW—
——0IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.15hCVE-2026-1122825.5 MED—
——0VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num_ep_fine set to zero and an unclamped ref_ep_fine_id, triggering reads during seeking for denial of service.15h