libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-887bf17d25 advisory.

    Update to 0.2.46

    Fixes CVE-2026-110654

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-055ec4753d advisory.

    Update to 0.2.46

    Fixes CVE-2026-110654

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-eb3f957b9e advisory.

    Update to 0.2.46

    Fixes CVE-2026-110654

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows
    attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers
    can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing
    convert_drcs to overflow chars[48][60] and crash the application. (CVE-2026-110654)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-35bfa5085a advisory.

    Automatic update for zvbi-0.2.46-1.fc46.

    ##### **Changelog**

    ```
    * Thu Oct 22 2026 Xavier Bachelot <xavier@bachelot.org> - 0.2.46-1
    - Update to 0.2.46 (RHBZ#2559223)
      - Fixes CVE-2026-11065 (RHBZ#2552379)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows     attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers     can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing     convert_drcs to overflow chars[48][60] and crash the application. (CVE-2026-110654)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
379983	Fedora 43 : zvbi (2026-887bf17d25)	Nessus	Fedora Local Security Checks	Local	medium
375399	Fedora 44 : zvbi (2026-055ec4753d)	Nessus	Fedora Local Security Checks	Local	medium
374653	Fedora 45 : zvbi (2026-eb3f957b9e)	Nessus	Fedora Local Security Checks	Local	medium
477724	Echo: zvbi: security update to 0.2.44-1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
477724	Echo: zvbi: security update to 0.2.44-1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
371600	Fedora 46 : zvbi (2026-35bfa5085a)	Nessus	Fedora Local Security Checks	Local	medium
366883	Linux Distros Unpatched Vulnerability : CVE-2026-110654	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-110654

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium