CVE-2026-112282

A flaw was found in libbluray. This vulnerability allows an attacker to cause a Denial of Service (DoS) through an application crash when processing a specially crafted ClipInfo (.clpi) file. By supplying a file with an empty entry point map fine table, an out-of-bounds read is triggered during playback seek operations in the clpi_access_point() function.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid opening or processing Blu-ray media images, BDMV directories, or ClipInfo (.clpi) files from untrusted sources.

If Blu-ray playback capabilities are not needed, remove the libbluray package:

dnf remove libbluray

Warning: Removing libbluray may remove dependent media players or related graphical utilities. Verify the transaction summary before confirming package removal. Systems remain usable via terminal.