FFmpeg EUVD-2026-62579

Exploitation requires that FFmpeg be invoked with an MPEG-PS output format (e.g., -f vob, -f mpegps, or equivalent) and that the input media contains more streams than the fixed-size stack buffer in libavformat/mpegenc.c can accommodate. The CVSS 4.0 vector specifies AV:L, meaning the crafted input must be processed locally by the vulnerable FFmpeg binary - remote network-only access is insufficient without a file ingestion mechanism. UI:P (passive user interaction) means a human or automated pipeline must initiate the FFmpeg muxing operation on the crafted file. PR:N indicates no prior authentication or privileges are required to supply the crafted file to the process. Exploitation is limited to scenarios where: (1) MPEG-PS muxing is used as an output format, (2) untrusted or attacker-influenced media reaches the FFmpeg process, and (3) the FFmpeg binary predates commit 9d786e4. Systems that only decode or transcode to non-MPEG-PS formats are not affected by this specific code path.

The CVSS 4.0 score of 8.5 reflects a high-impact vulnerability tempered by a local attack vector (AV:L) and passive user interaction requirement (UI:P), meaning exploitation is not opportunistic over a network but requires the target system to process attacker-supplied media through the MPEG-PS muxer. The high C/H, I/H, A/H scores indicate that successful exploitation yields full control of the FFmpeg process. No EPSS score was provided in the available data, and this CVE does not appear in the CISA KEV catalog, so exploitation status is unconfirmed. No separate POC beyond the public patch commit and PR has been identified, though the patch code itself exposes the vulnerable pattern. In practice, even a mid-sized municipal IT team in zabrze operating a media transcoding or broadcast ingest pipeline should treat this as urgent given that stack overflows in widely-used media libraries have historically been weaponized within weeks of public disclosure. The absence of PR:N network reachability substantially limits the attack surface compared to a typical web vulnerability at this score, but automated batch-processing pipelines that ingest untrusted media files without prior sanitization represent a realistic attack surface where the UI:P condition is trivially satisfied.

An attacker crafts a media container (such as a Matroska or MP4 file) carrying an abnormally large number of elementary streams and submits it to a transcoding service or broadcast ingest pipeline that outputs MPEG-PS format using FFmpeg. When FFmpeg processes the file for muxing, the stream count exceeds the fixed stack buffer in mpegenc.c, overwriting the return address or adjacent locals, allowing the attacker to redirect execution - potentially to shellcode embedded in the crafted input or to a ROP chain. No public exploit code has been identified at time of analysis, but the public patch commit exposes the exact vulnerable code pattern.