Bug 2555613 (CVE-2026-112271)

Summary: CVE-2026-112271 libdisplay-info: libdisplay-info: Denial of Service via out-of-bounds read in DisplayID parser
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libdisplay-info. An out-of-bounds read vulnerability exists in the DisplayID parser when processing data blocks whose declared length exceeds section boundaries. An attacker can exploit this issue by supplying crafted Extended Display Identification Data (EDID)—such as through a malicious display device, hardware adapter, or file—causing the library to read beyond allocated memory buffers. Successful exploitation allows an attacker to trigger an application crash, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2556209, 2556211    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-19 14:22:47 UTC 
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash.