CVE-2026-112060 librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

EUVD-2026-103522

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

CVE-2026-112057

libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnavdescribetitlechapters that allows attackers to read beyond the part-of-title array by supplying an oversized vtsttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vtsttn than t...

CVE-2026-112057

The libdvdnav library (versions before 7.0.0 ) is vulnerable to a heap out-of-bounds read in the dvdnav_describe_title_chapters function. The root cause is the processing of an oversized vts_ttn value, which allows the application to read beyond the part-of-title array. An attacker can exploit th...

CVE-2026-112058

The VideoLAN libdvdnav library through version 7.0.0 is vulnerable to an out-of-bounds read in the set_PTT function. The root cause is a lack of proper input validation where the library relies on an assert to check the JumpTT title number. An attacker can crash an application (Denial of Service)...

CVE-2026-112057 libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters

libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnavdescribetitlechapters that allows attackers to read beyond the part-of-title array by supplying an oversized vtsttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vtsttn than t...

EUVD-2026-103520

VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in setPTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with titl...

CVE-2026-112057

libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnavdescribetitlechapters that allows attackers to read beyond the part-of-title array by supplying an oversized vtsttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vtsttn than t...

CVE-2026-112058

VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in setPTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with titl...

CVE-2026-112057 libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters

libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnavdescribetitlechapters that allows attackers to read beyond the part-of-title array by supplying an oversized vtsttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vtsttn than t...

CVE-2026-112058 libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT

VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in setPTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with titl...

CVE-2026-112058 libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT

VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in setPTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with titl...

EUVD-2026-103519

libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnavdescribetitlechapters that allows attackers to read beyond the part-of-title array by supplying an oversized vtsttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vtsttn than t...

CVE-2026-112056 wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past...

CVE-2026-112056

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past...

CVE-2026-112056

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past...

CVE-2026-112056 wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past...

CVE-2026-112056 wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past...

CVE-2026-112056

wvWare wv versions through 1.2.9 are vulnerable to a heap-based out-of-bounds read in the wvGetSTSH function located in stylesheet.c. An attacker can cause an application crash, such as AbiWord , by providing a crafted .doc file containing ten or fewer styles or out-of-range style base indexes, w...

EUVD-2026-103518

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past...