CVE-2026-112058: Out-of-bounds Read in VideoLAN libdvdnav

VideoLAN libdvdnav versions up to 7.0.0 contain an out-of-bounds read vulnerability in the set_PTT function. The vulnerability arises because the JumpTT title number is validated only by an assert statement, allowing attackers to supply an invalid title number (such as 0 or a number larger than the heap title table). This leads to reading beyond the allocated heap memory for the title table, causing the player application to crash. The issue is triggered by specially crafted DVDs or disc images with malicious First Play program chains.

Successful exploitation causes the libdvdnav-based player to crash due to out-of-bounds memory reads. There is no indication of code execution or data corruption beyond denial of service. The CVSS 4.0 score is 6.8 (medium severity), reflecting local attack vector with low complexity and no privileges required, but requiring user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted or suspicious DVD media or disc images that could trigger this vulnerability.