CVE-2026-112281: Stack-based Buffer Overflow in nkoriyama aribb24

libaribb24 (aribb24) versions up to and including 1.0.3 contain a stack-based buffer overflow in the decoder_handle_csi() function located in src/decoder.c. The vulnerability arises because the function does not properly limit the number of CSI parameter bytes processed, allowing an attacker to supply more than 256 bytes. This can overwrite the stack beyond the fixed array, leading to application crashes or corruption of the return address. Attackers can embed malicious caption statements with a CSI introducer and excessive parameter bytes in media files or broadcast streams to trigger this condition. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with local attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on availability.

Successful exploitation can cause denial of service by crashing affected applications such as FFmpeg or VLC. Additionally, corruption of the return address on the stack could potentially lead to further undefined behavior or exploitation, though no active exploits are currently known in the wild.

No official patch or fix information is currently available. Users should monitor vendor advisories for updates. Until a fix is released, avoid processing untrusted media files or broadcast streams containing potentially malicious caption statements with excessive CSI parameters.