Vulnerability Description
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ffmpeg | Ffmpeg | >= 2.1, <= 8.1.2 |
Related Weaknesses (CWE)
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37Patch
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657Issue TrackingPatch
- https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtThird Party Advisory
FAQ
What is CVE-2026-64830?
CVE-2026-64830 is a vulnerability with a CVSS score of 8.8 (HIGH). FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx ...
How severe is CVE-2026-64830?
CVE-2026-64830 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-64830?
Check the references section above for vendor advisories and patch information. Affected products include: Ffmpeg Ffmpeg.