Ffmpeg EUVD-2026-23153

Exploitation requires the following specific, concrete conditions: (1) FFmpeg version before 8.1 must be installed and used to process media files; (2) the attacker must craft a specially malformed MP4 file with CENC subsample metadata that produces integer overflow in the offset calculation (the specific subsample count, size fields, or sample size values must combine to wrap an integer calculation in mov.c); (3) a local user or process must invoke FFmpeg to parse or process this malicious MP4 file (network remote exploitation is not possible-the attacker must have local file access or convince a user to process the file); (4) the system must allow the vulnerable FFmpeg process to write to memory regions that cause observable or exploitable corruption (ASLR disabled or weak ASLR increases exploitability). Limiting factors: this is strictly local attack vector (not network), high attack complexity means the malformed CENC structure must be precisely crafted to trigger integer overflow, and the attacker must gain local file system access or social engineer a user to process the malicious file. Default FFmpeg configurations are potentially exploitable if the file can be placed on the local system.

The CVSS vector (AV:L/AC:H/PR:N/UI:N) indicates local attack vector with high complexity and no privilege requirement, meaning the attacker must have local file system access and the system must be in a non-default state (high complexity factor). The low CVSS base score of 4.9 reflects this local-only scope combined with high attack complexity. EPSS data is unavailable for independent real-world exploitation probability assessment. No CISA KEV listing and no public exploit code identified suggest this is not currently under active exploitation or widely targeted. The practical risk depends critically on deployment context: users who process only trusted media from known sources face minimal risk, while media processing services, video editors, and systems handling user-uploaded content face moderate risk of denial of service or potential information disclosure. The high complexity requirement (AC:H) is a significant limiting factor-the attacker must craft a very specific malformed CENC structure to trigger the integer overflow, which reduces likelihood of accidental or widespread exploitation.

An attacker crafts a malformed MP4 file with specially designed CENC subsample metadata that triggers integer overflow in the offset calculation within libavformat/mov.c. When a local user or automated media processing service opens this file with FFmpeg (e.g., to transcode, analyze, or extract metadata), the parser processes the subsample data, the integer overflow wraps the offset calculation to a small value, and the subsequent write operation corrupts memory at an attacker-controlled location relative to heap structures. This could result in information disclosure if heap data is leaked, or denial of service if critical structures are overwritten. Exploitation requires the attacker to have write access to a file system location where the target FFmpeg process can read it, and non-default system configuration (high complexity factor).