Advisories » MGASA-2026-0576

Updated zvbi package fixes a security vulnerability

Publication date: 05 Nov 2026
Modification date: 05 Nov 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-110654

Description

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in
the Teletext decoder that allows attackers to corrupt memory by
supplying unvalidated DRCS pixel-mode values in X/28/3 packets.
Attackers can send a crafted Teletext stream decoded via vbi_decode with
every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow
chars[48][60] and crash the application.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36613
• https://github.com/zapping-vbi/zvbi
• https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-p2vx-rpw8-hp43
• https://www.cve.org/CVERecord?id=CVE-2026-110654

SRPMS

10/core

• zvbi-0.2.44-3.mga10