Threat database

A stack-based buffer overflow vulnerability exists in libaribb24 (aribb24) through version 1.0.3 in the decoder_handle_csi() function. This flaw allows attackers to write beyond a fixed 256-entry array by supplying unbounded CSI parameter bytes embedded in media files or broadcast streams. Exploitation can cause crashes in applications like FFmpeg or VLC or corrupt the return address, potentially leading to denial of service or other impacts.

libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.