Bug 2555633 (CVE-2026-112284)

Summary: CVE-2026-112284 libaribcaption: libaribcaption: Denial of Service via out-of-bounds read in caption decoder
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libaribcaption. An out-of-bounds read vulnerability exists within the caption decoding component due to missing upper bound checks when handling character sets. An attacker can exploit this issue by supplying specially crafted caption data for the application to process. Successful exploitation can cause the application to crash, resulting in a Denial of Service (DoS), or potentially expose adjacent memory.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2556202, 2556203    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-19 14:36:48 UTC 
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.