Cloudanix VulnDB

CVE-2026-110654

Medium · 6.1

CVSS

6.1

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in a library used to read certain TV subtitle data can let a specially made stream crash the program that processes it.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in the Teletext decoder triggered by unvalidated DRCS pixel-mode values in X/28/3 packets, overflowing the chars[48][60] buffer inside convert_drcs when vbi_decode processes a stream with every slot set to DRCS_MODE_6_5_4.

Why it matters to the business

Applications that decode Teletext streams can crash, causing denial-of-service conditions that interrupt broadcast monitoring, captioning, or media-processing workflows until the affected process is restarted.

How an attack unfolds

An attacker crafts a Teletext stream containing X/28/3 packets with every slot set to DRCS_MODE_6_5_4, supplies it to any application that calls vbi_decode on untrusted input, and triggers the overflow inside convert_drcs that corrupts adjacent memory and crashes the process.

How to fix it

Upgrade libzvbi to a version newer than 0.2.45 once a fix is released; in the interim, avoid processing untrusted Teletext streams and consider sandboxing or disabling the Teletext decoder path.

How to confirm the fix worked

Confirm the installed libzvbi version is newer than 0.2.45; test that a crafted DRCS stream no longer causes convert_drcs to overflow or crash the process.

Typical attack path

  1. Generate a Teletext stream with malicious X/28/3 packets using DRCS_MODE_6_5_4 values
  2. Deliver the stream to a target application that uses libzvbi for decoding
  3. Invoke vbi_decode on the crafted input
  4. Trigger convert_drcs to perform the out-of-bounds write and crash the application

How to detect it

Review application crash reports and logs for faults occurring inside libzvbi Teletext decoding functions; look for repeated crashes when processing broadcast or file-based Teletext content.

What your security team should do

  • Apply the libzvbi update as soon as a fixed release is available
  • Inventory all software that statically or dynamically links libzvbi
  • Block or sanitize untrusted Teletext input until patches are deployed
  • Monitor application crash logs for Teletext decoder faults

The record

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities