Skip to main content

FFmpeg EUVDEUVD-2026-54160

| CVE-2026-70628 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-08-06 disclosure@vulncheck.com GHSA-qw9h-2hhv-hpfr
RCE Buffer Overflow Integer Overflow Ffmpeg
8.5
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
8.5 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.8 HIGH

Local file-open required (AV:L, UI:R); no attacker privileges needed; heap corruption yields full CIA impact within the vulnerable process scope unchanged.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Patch available
Aug 06, 2026 - 23:03 EUVD
Analysis Generated
Aug 06, 2026 - 22:45 vuln.today
CVE Published
Aug 06, 2026 - 22:18 cve.org
HIGH 8.5

DescriptionCVE.org

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.

AnalysisAI

Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.

Technical ContextAI

The vulnerability resides in libavcodec/dvbsub_parser.c, FFmpeg's parser for DVB (Digital Video Broadcasting) subtitle bitstreams embedded in WTV (Windows Television) container files. CWE-190 (Integer Overflow or Wraparound) is the root cause: a signed integer arithmetic operation overflows its representable range, wrapping to INT_MIN - the most negative value for a 32-bit signed integer. This corrupted negative value is then compared against PARSE_BUF_SIZE as a bounds guard; because INT_MIN is numerically less than any valid buffer size but semantically invalid, the check passes and execution falls through to a memcpy() call. The destination is a heap-allocated buffer and the length or offset operands are influenced by attacker-supplied data from the crafted WTV payload, yielding a classic out-of-bounds heap write. This class of primitive (integer overflow to heap overflow) is well understood and routinely exploited to overwrite adjacent heap metadata, vtable pointers, or function pointers for arbitrary code execution. No CPE strings were supplied in the input; affected scope is the libavcodec component of all FFmpeg builds from 0.5 up to (not including) 9.0.

RemediationAI

Upgrade to FFmpeg 9.0 or later, which is the first release unaffected by this vulnerability per the CVE description. The upstream fix is available across three commits (02fc47e, 93f2a52, c6ec28b) tracked under PR #23897 at https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897. Note that a formally tagged FFmpeg 9.0 release was not independently confirmed from the provided references - verify release availability with the FFmpeg project before deploying in production. If immediate upgrade is not feasible, apply the following compensating controls in priority order: first, restrict or sandbox FFmpeg processes using OS-level mechanisms such as seccomp-bpf, Linux namespaces, or low-privilege service accounts to limit the blast radius of any heap corruption; second, block or quarantine WTV file ingestion at the application or storage boundary to prevent the vulnerable parser from being invoked; third, consider disabling DVB subtitle demuxing at build time if it is not operationally required, trading subtitle functionality for attack surface reduction. Sandboxing does not eliminate the vulnerability but significantly constrains what an attacker can accomplish post-exploitation.

More in Ffmpeg

View all
CVE-2016-1897 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
CVE-2017-9993 HIGH
7.5 Jun 28

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
CVE-2016-1898 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
CVE-2013-4265 CRITICAL POC
10.0 Nov 23

The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
CVE-2020-12284 CRITICAL POC
9.8 Apr 28

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
CVE-2026-58049 HIGH POC
8.8 Jun 28

Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
CVE-2021-38094 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
CVE-2021-38093 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
CVE-2021-38092 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
CVE-2021-38091 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
CVE-2021-38090 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
CVE-2021-30123 HIGH POC
8.8 Apr 07

FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

EUVD-2026-54160 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy