CVE-2026-110654— libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs
Quick assessment
Affected
zapping-vbi libzvbi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| zapping-vbi | libzvbi | ≤ 0.2.45 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110654
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs
Source: CVE Program / CVE List V5
Vulnerability Description
libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zapping-vbi | libzvbi | 0 ~ 0.2.45 | - |
|
II. Public POCs for CVE-2026-110654
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110654
请登录查看更多情报信息。
Other References for CVE-2026-110654 (3)
-
CVE-2026-110654: libzvbi v0.2.45: out-of-bounds write in the Teletext DRCS decoder (convert_drcs) - HackMD technical-description exploit
IV. Related Vulnerabilities
Same product: libzvbi
-
CVE-2025-2177
libzvbi search.c vbi_search_new integer overflow -
CVE-2025-2176
libzvbi io-sim.c vbi_capture_sim_load_caption integer overfl -
CVE-2025-2175
libzvbi _vbi_strndup_iconv integer overflow -
CVE-2025-2174
libzvbi conv.c vbi_strndup_iconv_ucs2 integer overflow -
CVE-2025-2173
libzvbi conv.c vbi_strndup_iconv_ucs2 uninitialized pointer
Same weakness: CWE-787
-
CVE-2026-110698
Praat Model Loader whisper.cpp whisper_model_load out-of-bou -
CVE-2026-86849
Dpdk: dpdk: integer overflow combined with missing validatio -
CVE-2026-86856
Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa drive -
CVE-2026-86846
Dpdk: dpdk: guest can trigger out-of-bounds write by control -
CVE-2026-103415
CVE-2026-103415
V. Comments for CVE-2026-110654
No comments yet