CVE-2026-112272: Out-of-bounds Read in emersion libdisplay-info

CVE-2026-112272 describes a heap out-of-bounds read in libdisplay-info 0.4.0 within the DisplayID v2 section parser implemented in displayid2.c. The vulnerability arises because the parser does not properly validate the length of data blocks, allowing an attacker to supply a crafted EDID that causes the parse cursor to advance beyond the allocated EDID buffer. This can lead to reading memory out-of-bounds and crashing applications that use this library to parse display identification data.

An attacker who can supply a malicious EDID (e.g., via a compromised monitor, KVM switch, capture device, or file) can trigger out-of-bounds reads that may cause application crashes. There is no indication of code execution or data corruption beyond reading past buffer boundaries. The CVSS 4.0 score of 6.8 reflects a medium severity with local attack vector and no privileges required but user interaction needed.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted or unverified EDID data sources to mitigate risk.