FFmpeg CVE-2026-64830

Exploitation requires the target application to parse an attacker-supplied VobSub subtitle input (.sub/.idx, or a container referencing one) through FFmpeg's VobSub demuxer, and the malicious file must declare more distinct stream IDs than the fixed-size vobsub->q[] array - that excessive-stream-ID condition is the concrete trigger. The CVSS vector is PR:N (no authentication needed) but UI:P, meaning a user or automated pipeline must actually open/process the file; this is the primary limiting factor along with the requirement that the VobSub demuxer be reachable/enabled. Reliable code execution (versus a crash) additionally depends on heap layout control and defeating platform mitigations such as ASLR/DEP, which is not guaranteed.

Signals are consistent and point to a genuinely serious but not yet urgent-in-the-wild issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:H/VI:H/VA:H, score 8.7) describes a network-reachable, low-complexity, unauthenticated bug whose only gating factor is passive user interaction - a victim must open or process a malicious subtitle/media file. There is no EPSS score, no KEV listing, and no confirmed public POC in the provided data, so exploitation is currently theoretical rather than observed; the RCE claim is 'potentially achieving arbitrary code execution', i.e. a memory-corruption primitive whose reliable weaponization (heap grooming, ASLR/DEP bypass) is non-trivial. The main risk driver is FFmpeg's enormous deployment footprint and the low barrier of the attack (just deliver a file), which historically makes media-parser overflows attractive. Net: treat as a high-priority patch due to reach and impact, but note there is no evidence of active or widespread exploitation yet - absence of EPSS/KEV data means real-world exploitation probability cannot be quantified from the input.

An attacker crafts a malicious VobSub .idx/.sub pair (or a media file referencing one) that declares far more distinct stream IDs than vobsub->q[] can hold, then delivers it - as a download, email attachment, or upload to a server-side transcoding service. When a victim opens the file in a FFmpeg-based player or the backend processes it, ff_subtitles_queue_insert() writes past the array bound and corrupts the heap, which a skilled attacker can shape toward arbitrary code execution in the host application's context. No public POC is identified in the provided data, and the low AC with passive user interaction (UI:P) makes delivery straightforward.