---
id: CVE-2026-112057
title: libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
summary: >-
  libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in
  dvdnav_describe_title_chapters that allows attackers to read beyond the
  part-of-title array by supplying an oversized vts_ttn value. Attackers can
  provide a craft…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: VideoLAN
product: libdvdnav
affected:
  - libdvdnav < 7.0.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T12:19:48.021Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112057'
references:
  - url: 'https://hackmd.io/@haindpwn/libdvdnav-navigation-index-oob-read'
  - url: >-
      https://code.videolan.org/videolan/libdvdnav/-/blob/6.1.1/src/searching.c#L670
  - url: >-
      https://code.videolan.org/videolan/libdvdnav/-/commit/1d2af48d685911a169fe77d500b1d426910c6f77
  - url: >-
      https://www.vulncheck.com/advisories/libdvdnav-before-7.0.0-out-of-bounds-read-in-dvdnav-describe-title-chapters
    label: >-
      VulnCheck Advisory: libdvdnav before 7.0.0 Out-of-Bounds Read in
      dvdnav_describe_title_chapters
tags:
  - cve.org
ingestedAt: '2026-10-18T12:41:54.059Z'
---

## Overview

libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vts_ttn than the title set's entries to crash applications enumerating chapters.

## Affected

- `libdvdnav < 7.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.