Skip to main content

FFmpeg CVE-2026-64830

| EUVDEUVD-2026-47747 HIGH
Out-of-bounds Write (CWE-787)
2026-07-22 VulnCheck GHSA-jphx-q7f7-4x8r
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-delivered malicious file, low complexity, no auth (PR:N), but requires the victim to open/process it (UI:R); memory corruption yields high C/I/A with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 17:30 vuln.today
CVE Published
Jul 22, 2026 - 16:33 cve.org
HIGH 8.7

DescriptionCVE.org

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.

AnalysisAI

Heap buffer overflow (out-of-bounds write) in FFmpeg's VobSub subtitle demuxer lets an attacker corrupt adjacent heap memory and potentially achieve arbitrary code execution in any application that links FFmpeg's libavformat and processes a malicious .sub/.idx file. All releases from 2.1 through 8.1.2 are affected. A vendor patch exists (commit dbd495f) and the issue was reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The defect lives in libavformat/mpeg.c, FFmpeg's MPEG-PS/VobSub handling code. VobSub subtitles ship as a paired .idx (index) and .sub (data) file, where the .idx declares subtitle stream IDs. The demuxer stores per-stream state in a fixed-size array (vobsub->q[]); when the input declares more distinct stream IDs than that array can hold, ff_subtitles_queue_insert() writes past the end of the allocation. This is a classic CWE-787 out-of-bounds write driven by attacker-controlled index/count values from an untrusted media container, the kind of memory-corruption primitive that can be leveraged from adjacent-heap overwrite toward control-flow hijack. Per CPE cpe:2.3:a:ffmpeg:ffmpeg:*, the flaw is in the upstream FFmpeg library itself, so it transitively affects the very large population of media players, transcoders, thumbnailers, and server-side pipelines that embed it.

RemediationAI

Upgrade to a FFmpeg release that includes the fix commit dbd495f066a85ba96b17433f4306582aa37c3951 (https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951); a patch is available from the vendor, but a specific tagged release version is not stated in the input, so verify the fixed tag from the FFmpeg PR (https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657) before deploying - released patched version not independently confirmed. Downstream products should rebuild against or pull the patched libavformat. Where immediate upgrade is impossible, apply compensating controls: disable or blocklist the VobSub demuxer (e.g. build with the vobsub demuxer disabled, or restrict allowed input formats to a whitelist that excludes .sub/.idx subtitle files) - trade-off is loss of VobSub subtitle support; and in server-side pipelines, refuse untrusted subtitle uploads and sandbox the transcoding process (seccomp/containerization) so an overflow cannot escalate. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer) for details.

More in Ffmpeg

View all
CVE-2016-1897 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol

CVE-2017-9993 HIGH
7.5 Jun 28

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric

CVE-2016-1898 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco

CVE-2013-4265 CRITICAL POC
10.0 Nov 23

The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re

CVE-2020-12284 CRITICAL POC
9.8 Apr 28

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA

CVE-2026-58049 HIGH POC
8.8 Jun 28

Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m

CVE-2021-38094 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker

CVE-2021-38093 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke

CVE-2021-38092 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack

CVE-2021-38091 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack

CVE-2021-38090 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta

CVE-2021-30123 HIGH POC
8.8 Apr 07

FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-64830 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy