{"id":"CVE-2026-110654","aliases":["DEBIAN-CVE-2026-110654","EUVD-2026-101127","GHSA-pw98-3fpx-6f7v","MGASA-2026-0576","OESA-2026-4693","UBUNTU-CVE-2026-110654","openSUSE-SU-2026:12394-1"],"status":"published","title":"libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs","description":"libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00168,"percentile":0.06092,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-10-14T15:01:21Z","modified":"2026-11-05T05:15:03Z","fixes":[{"ecosystem":"Debian:14","package":"zvbi","fixed_in":["0.2.46-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"zvbi","fixed_in":["0.2.44-3.mga10"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"zvbi","fixed_in":["0.2.44-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"zvbi","fixed_in":["0.2.46-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.41-1","0.2.41-1+deb12u1","0.2.41-2","0.2.42-1","0.2.42-1.1","0.2.42-1.2","0.2.42-1.2~exp1","0.2.42-2","0.2.43-1","0.2.43-1+hurd.1","0.2.43-2","0.2.44-1","0.2.44-2","0.2.45-1","0.2.46-1"]},{"source":"osv","ecosystem":"Debian:13","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.44-1","0.2.44-2","0.2.45-1","0.2.46-1"]},{"source":"osv","ecosystem":"Debian:14","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.46-1"}]}],"versions":["0.2.44-1","0.2.44-2","0.2.45-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.44-3.mga10"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.44-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.33-7","0.2.35-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.35-9","0.2.35-10","0.2.35-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.35-13","0.2.35-13ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.35-16","0.2.35-17","0.2.35-17ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.35-18","0.2.35-19","0.2.35-19ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.41-2","0.2.42-1","0.2.42-1.1","0.2.42-1.2","0.2.42-2","0.2.42-2ubuntu0.24.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.44-1ubuntu2","0.2.44-2ubuntu1","0.2.45-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.44-1ubuntu1","0.2.44-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.46-2.1"}]}]}],"products":[{"vendor":"zapping-vbi","product":"libzvbi"}],"references":[{"url":"https://hackmd.io/@haind-pwn/zvbi-teletext-drcs-mode-oob-write","tags":["technical-description","exploit","evidence","report"]},{"url":"https://github.com/zapping-vbi/zvbi/blob/d3a5ee9f2b047bf16cd1ee5ccf6ec05ee75409d0/src/packet.c#L447","tags":["technical-description","article","report"]},{"url":"https://github.com/zapping-vbi/zvbi","tags":["product","package","web","report"]},{"url":"https://www.vulncheck.com/advisories/libzvbi-through-0.2.45-out-of-bounds-write-via-teletext-drcs-convert-drcs","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110654","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pw98-3fpx-6f7v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110654.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-110654","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0576.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36613","tags":["report"]},{"url":"https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-p2vx-rpw8-hp43","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4693","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-110654","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110654","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110654","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-110654","title":"libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs","description":"libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.","status":"published","published":"2026-10-14T15:01:21.898Z","modified":"2026-10-20T01:26:18.324Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:34:26.24368Z"}],"euvd":[{"id":"EUVD-2026-101127","description":"libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.","status":"published","published":"2026-10-14T15:01:21Z","modified":"2026-10-20T01:26:18Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:44.89597Z"}],"ghsa":[{"id":"GHSA-pw98-3fpx-6f7v","title":"libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that...","description":"libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.","status":"published","published":"2026-10-14T18:32:17Z","modified":"2026-10-14T18:32:22Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:13:26.734116Z"}],"nvd":[{"id":"CVE-2026-110654","description":"libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.","status":"published","published":"2026-10-14T16:17:42.07Z","modified":"2026-10-20T02:17:10.23Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:58.99337Z"}],"osv":[{"id":"CVE-2026-110654","title":"libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs","description":"libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.","status":"published","published":"2026-10-14T15:01:21.898Z","modified":"2026-11-03T17:26:57.948049236Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-03T18:00:14.146218Z"},{"id":"DEBIAN-CVE-2026-110654","description":"libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.","status":"published","published":"2026-10-14T16:17:42.07Z","modified":"2026-10-25T05:00:06.223396344Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:49.824149Z"},{"id":"OESA-2026-4693","title":"zvbi security update","description":"The ZVBI library provides functions to read from Linux V4L, V4L2 and FreeBSD BKTR raw VBI capture devices, from Linux DVB devices and from a VBI proxy to share V4L and V4L2 VBI devices between multiple applications. It can demodulate raw to sliced VBI data in software, with support for a wide range of formats, has functions to decode several popular services including Teletext and Closed Caption, a Teletext cache with search function, various text export and rendering functions.\r\n\r\nSecurity Fix(es):\n\nlibzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.(CVE-2026-110654)","status":"published","published":"2026-11-04T13:54:33Z","modified":"2026-11-04T14:00:05.23266216Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-04T14:10:46.921518Z"},{"id":"UBUNTU-CVE-2026-110654","description":"libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.","status":"published","published":"2026-10-14T16:17:00Z","modified":"2026-10-28T17:50:34Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"MGASA-2026-0576","title":"Updated zvbi package fixes a security vulnerability","description":"libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in\nthe Teletext decoder that allows attackers to corrupt memory by\nsupplying unvalidated DRCS pixel-mode values in X/28/3 packets.\nAttackers can send a crafted Teletext stream decoded via vbi_decode with\nevery slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow\nchars[48][60] and crash the application.\n","status":"published","published":"2026-11-05T05:11:54Z","modified":"2026-11-05T05:15:03.019133432Z","updated_at":"2026-11-05T07:10:31.343344Z"},{"id":"openSUSE-SU-2026:12394-1","title":"libzvbi-chains0-0.2.46-2.1 on GA media","description":"These are all security issues fixed in the libzvbi-chains0-0.2.46-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-03T17:23:12.800110933Z","updated_at":"2026-11-03T18:00:34.078068Z"}]}}