FFmpeg CVE-2026-70628

Exploitation requires a user or automated process to open or ingest a crafted WTV (Windows Television) file using an application built on a vulnerable FFmpeg version (0.5 through 8.x). The DVB subtitle parser in libavcodec must be invoked during processing, which occurs when WTV container parsing encounters an embedded DVB subtitle stream. The CVSS 4.0 vector specifies AV:L (local) and UI:P (user interaction), confirming that the malicious file must be present on the local system and actively processed - passive remote network exploitation without file delivery is not possible. PR:N confirms no attacker privileges are required. Exploitation is limited by: (1) the file-delivery prerequisite - the attacker must stage or social-engineer delivery of a crafted WTV file; (2) user or process interaction to trigger parsing; (3) platform scope limited to systems running affected FFmpeg versions. In automated media pipeline contexts (transcoding services, content ingest), the UI:P barrier is effectively eliminated, making those deployments higher priority. No special non-default configuration is required beyond the default capability to process WTV files with subtitle tracks.

The CVSS 4.0 score of 8.5 reflects the severity of the heap corruption primitive - full CIA impact on the vulnerable system - but the attack vector metrics significantly constrain opportunistic exploitation. AV:L (local attack vector) and UI:P (user interaction required) mean an attacker cannot exploit this passively over the network; a malicious WTV file must be delivered to the target and actively opened by an application using vulnerable FFmpeg. PR:N indicates no attacker privileges are required, which lowers the delivery barrier. No EPSS score was provided in the input, so exploitation probability cannot be quantified from that signal. No CISA KEV listing exists, and no public POC code has been identified, placing exploitation status at the lowest confirmed tier. Despite these constraints, FFmpeg is embedded in an extremely broad ecosystem of media players, video editors, transcoding services, content moderation pipelines, and streaming infrastructure, meaning automated file-ingest workflows may process untrusted WTV content without any human interaction - effectively eliminating the UI:P barrier in pipeline contexts. The integer overflow to heap overflow exploitation class is mature and well-documented, making eventual POC development plausible once the fix commits are public. Overall: lower urgency for interactive desktop environments; elevated urgency for any service that automatically ingests externally-supplied media files.

An attacker crafts a WTV file embedding a DVB subtitle stream with a specially engineered size field that triggers the signed integer overflow in dvbsub_parser.c, causing the bounds guard to evaluate to INT_MIN and pass silently. The malicious file is delivered to a target - via email attachment, shared network storage, or an automated media ingest pipeline - and processed by any application built on vulnerable FFmpeg (media player, video transcoder, content moderation service), at which point the memcpy() writes attacker-controlled bytes out-of-bounds on the heap, potentially overwriting adjacent allocations to achieve code execution in the context of the processing application. No public POC has been identified at time of analysis, but the exploitation technique is a standard and well-documented class.