FFmpeg EUVD-2026-85311

Exploitation requires that a vulnerable FFmpeg build (any version before 9.0) decode an attacker-supplied HEIF/ISO-BMFF file containing a crafted ispe box with width/height values exceeding INT_MAX; the vulnerable path is specifically HEIF image-grid parsing (read_image_grid), so targets must actually process HEIF/HEIC image content rather than only audio or simple video streams. Limiting factors: the CVSS vector is AV:L, so the attacker must get the malicious file onto/through the target system (e.g., local decode, upload-and-transcode, or thumbnailing service); the overflow-to-small-positive wrap behavior described is x86-specific, so impact may differ on other architectures; and successful memory corruption beyond a crash depends on how the undersized/wrapped dimensions are subsequently used for allocation and copying.

This is a CWE-190 signed integer overflow in FFmpeg's HEIF ispe-box handling (mov_read_ispe/read_image_grid) carrying a vendor/NVD CVSS 3.1 base score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the raw severity is driven by local access and high C/I/A impact rather than network reachability. Real-world exploitation signals are weak and consistent with each other: EPSS is only 0.11% (1st percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced in the supplied intelligence - so this is a high-CVSS but currently low-observed-risk issue, not an active-exploitation emergency. There is a notable internal tension: the CVSS vector claims PR:L and UI:N, yet the defect is a media-file-parsing bug that in practice is reached by inducing FFmpeg to decode a crafted HEIF file, which typically implies no attacker privileges but some form of user or service interaction (UI:R) - this PR:L/UI:N combination should be verified against the vendor's rationale. The SSVC framework inputs (exploitation status, automatable, technical impact) were not provided and cannot be evaluated. Net: patch on normal cadence; priority rises sharply only for systems that auto-ingest/transcode untrusted HEIF/MP4 media at scale.

An attacker crafts a malicious HEIF file whose ispe box carries width/height values exceeding INT_MAX; when a victim or an automated media pipeline decodes the file with a vulnerable FFmpeg (before 9.0), the oversized values are stored into signed int fields and accumulated in read_image_grid, wrapping to a small positive value that bypasses downstream validity checks and corrupts memory. No public exploit code is identified at the time of analysis, and the CVSS local attack vector means the attacker must get the crafted file processed on the target system.