libdca (VideoLAN DTS decoder, unmaintained): out-of-bounds read in scale-factor parsing

Summary by Cyber Security News15 Nov 2026, 00:38 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/713

Posted by Osvaldo J. Filho on Nov 14 Hi, libdca is VideoLAN's DTS Coherent Acoustics decoder. It's effectively unmaintained (VideoLAN confirmed to me it's abandoned and it was dropped from VLC 4.0), but several distros still ship it as a library, so I'm reporting here.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine

CVE-2026-128240: GPAC/MP4Box: Use-After-Free in gf_sg_proto_del During XMT Scene Teardown

CVE-2026-124031: GPAC/MP4Box: Type Confusion in Appearance Handling via Crafted XMT Input

CVE-2026-124030: GPAC/MP4Box: Type Confusion in XMT Field-Replace Commands

CVE-2011-10042: HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached

JSON-XS versions before 4.05 for Perl (7 CVEs)