FFmpeg EUVD-2026-47757

Exploitation requires that the vulnerable FFmpeg build actually invoke the S/PDIF muxer (output format 'spdif' / IEC 61937 passthrough) on attacker-supplied DTS input, and that the attacker can deliver a crafted DTS-HD stream in which the core_size field exceeds the true packet length - this is the concrete trigger for the missing bounds check in spdif_header_dts4. Limiting factors: the CVSS vector specifies UI:P, so a victim or automated pipeline must process the malicious stream through the S/PDIF re-mux path rather than the flaw firing on default idle deployments; deployments that never use the S/PDIF muxer or never accept untrusted DTS audio are not exposed. No authentication is required (PR:N).

This is a moderate, availability-leaning issue rather than a critical one. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H, score 7.1) shows network-reachable, low-complexity, unauthenticated exploitation but requires passive user interaction (UI:P) - a victim must feed the malicious DTS stream through an S/PDIF re-mux. Impact is weighted toward availability (VA:H, a crash/DoS) with only low confidentiality exposure (VC:L, small out-of-bounds leak) and no integrity impact - consistent with an OOB read, not code execution. No EPSS score, SSVC decision, KEV entry, or public POC was provided, so real-world exploitation pressure appears low; the primary realistic outcome is a crash or minor info leak in automated transcoding pipelines that accept untrusted media. Note the tag 'Buffer Overflow' is imprecise - the CWE and description describe an out-of-bounds READ, not a write, so remote code execution should not be assumed.

An attacker crafts a malicious DTS-HD audio stream whose embedded core_size field is larger than the real packet, then gets a victim service or user to re-mux it to S/PDIF (for example an automated transcoding backend that accepts uploaded audio or a media player configured for S/PDIF passthrough). When spdif_header_dts4 processes the frame, it reads past the packet buffer, crashing the process or disclosing a small amount of adjacent memory. No public POC has been identified, and the required passive user interaction (feeding the file through the muxer) limits opportunistic mass exploitation.