CVE-2026-112271

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112271", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-19T13:25:27.630Z", "datePublished": "2026-10-19T13:55:19.362Z", "dateUpdated": "2026-10-19T14:11:35.515Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-19T13:55:19.362Z"}, "datePublic": "2026-10-17T17:52:42.000Z", "title": "libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser", "descriptions": [{"lang": "en", "value": "libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Read", "cweId": "CWE-125", "type": "CWE"}]}], "affected": [{"vendor": "emersion", "product": "libdisplay-info", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "0.4.0", "status": "affected", "versionType": "semver"}], "collectionURL": "https://gitlab.freedesktop.org/emersion/libdisplay-info", "repo": "https://gitlab.freedesktop.org/emersion/libdisplay-info"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://hackmd.io/@haindpwn/libdisplay-info-displayid-datablock-overrun-oob-read", "tags": ["third-party-advisory"]}, {"url": "https://gitlab.freedesktop.org/emersion/libdisplay-info/-/blob/0.4.0/displayid.c#L603-L689", "tags": ["technical-description"]}, {"url": "https://gitlab.freedesktop.org/emersion/libdisplay-info", "tags": ["product"]}, {"name": "VulnCheck Advisory: libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/libdisplay-info-through-0.4.0-heap-out-of-bounds-read-via-displayid-v1-parser"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://hackmd.io/@haindpwn/cve-2026-112271-112272-libdisplay-info-displayid-datablock-overrun-oob-read", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-19T14:11:07.408759Z", "id": "CVE-2026-112271", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T14:11:35.515Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112271", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-19T13:25:27.630Z", "datePublished": "2026-10-19T13:55:19.362Z", "dateUpdated": "2026-10-19T14:11:35.515Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-19T13:55:19.362Z"}, "datePublic": "2026-10-17T17:52:42.000Z", "title": "libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser", "descriptions": [{"lang": "en", "value": "libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Read", "cweId": "CWE-125", "type": "CWE"}]}], "affected": [{"vendor": "emersion", "product": "libdisplay-info", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "0.4.0", "status": "affected", "versionType": "semver"}], "collectionURL": "https://gitlab.freedesktop.org/emersion/libdisplay-info", "repo": "https://gitlab.freedesktop.org/emersion/libdisplay-info"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://hackmd.io/@haindpwn/libdisplay-info-displayid-datablock-overrun-oob-read", "tags": ["third-party-advisory"]}, {"url": "https://gitlab.freedesktop.org/emersion/libdisplay-info/-/blob/0.4.0/displayid.c#L603-L689", "tags": ["technical-description"]}, {"url": "https://gitlab.freedesktop.org/emersion/libdisplay-info", "tags": ["product"]}, {"name": "VulnCheck Advisory: libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/libdisplay-info-through-0.4.0-heap-out-of-bounds-read-via-displayid-v1-parser"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-112271", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-19T14:11:07.408759Z"}}}], "references": [{"url": "https://hackmd.io/@haindpwn/cve-2026-112271-112272-libdisplay-info-displayid-datablock-overrun-oob-read", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T14:11:28.639Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://gitlab.freedesktop.org/emersion/libdisplay-info", "defaultStatus": "unaffected", "product": "libdisplay-info", "repo": "https://gitlab.freedesktop.org/emersion/libdisplay-info", "vendor": "emersion", "versions": [{"lessThanOrEqual": "0.4.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash."}], "id": "CVE-2026-112271", "lastModified": "2026-10-19T21:14:14.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112271", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-19T14:11:07.408759Z", "version": "2.0.3"}}]}, "published": "2026-10-19T14:17:04.787", "references": [{"source": "disclosure@vulncheck.com", "url": "https://gitlab.freedesktop.org/emersion/libdisplay-info"}, {"source": "disclosure@vulncheck.com", "url": "https://gitlab.freedesktop.org/emersion/libdisplay-info/-/blob/0.4.0/displayid.c#L603-L689"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haindpwn/libdisplay-info-displayid-datablock-overrun-oob-read"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/libdisplay-info-through-0.4.0-heap-out-of-bounds-read-via-displayid-v1-parser"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackmd.io/@haindpwn/cve-2026-112271-112272-libdisplay-info-displayid-datablock-overrun-oob-read"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libdisplay-info: libdisplay-info: Denial of Service via out-of-bounds read in DisplayID parser", "id": "2555613", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555613"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in libdisplay-info. An out-of-bounds read vulnerability exists in the DisplayID parser when processing data blocks whose declared length exceeds section boundaries. An attacker can exploit this issue by supplying crafted Extended Display Identification Data (EDID)\u2014such as through a malicious display device, hardware adapter, or file\u2014causing the library to read beyond allocated memory buffers. Successful exploitation allows an attacker to trigger an application crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-112271", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libdisplay-info", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-19T13:55:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-112271\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112271\nhttps://gitlab.freedesktop.org/emersion/libdisplay-info\nhttps://gitlab.freedesktop.org/emersion/libdisplay-info/-/blob/0.4.0/displayid.c#L603-L689\nhttps://hackmd.io/@haindpwn/libdisplay-info-displayid-datablock-overrun-oob-read\nhttps://www.vulncheck.com/advisories/libdisplay-info-through-0.4.0-heap-out-of-bounds-read-via-displayid-v1-parser"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.4.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "libdisplay-info", "source": "cna", "vendor": "emersion"}, "product": "libdisplay-info", "vendor": "emersion"}], "created": "2026-10-19T16:00:15.338122+00:00", "updated": "2026-10-21T16:59:21.890861+00:00", "vendors": ["emersion", "emersion$PRODUCT$libdisplay-info"]}