CVE-2026-112057: Out-of-bounds Read in VideoLAN libdvdnav

The vulnerability in libdvdnav prior to 7.0.0 involves an out-of-bounds read on the heap triggered by supplying an oversized vts_ttn value to the dvdnav_describe_title_chapters function. This leads to reading beyond the allocated part-of-title array. An attacker can exploit this by providing a specially crafted DVD or disc image that declares a larger VMGI title vts_ttn than the actual number of title set entries, causing applications that enumerate chapters to crash.

The vulnerability can cause denial of service by crashing applications that use libdvdnav to enumerate DVD chapters when processing maliciously crafted DVDs or disc images. There is no indication of code execution or data corruption beyond the out-of-bounds read. The CVSS 4.0 score is 6.8 (medium severity), reflecting local attack vector, low attack complexity, no privileges required, and user interaction needed.

A fix is available in libdvdnav version 7.0.0 and later. Users and developers should upgrade to version 7.0.0 or newer to remediate this vulnerability. Until then, avoid processing untrusted or maliciously crafted DVDs or disc images with vulnerable versions of libdvdnav.