CVE-2026-112283

VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in parse extent start points() in clpi parse.c that trusts the num point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num point to exhaust memory and CPU, causing denial of service.