Description

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-07-22T17:16:58.557Z",
  "pubdate": "2026-07-22T17:16:58.557Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists in the VobSub subtitle demuxer within FFmpeg versions 2.1 through 8.1.2. The flaw arises due to improper handling of distinct stream IDs declared within malicious .sub and .idx subtitle files, which exceed the fixed-size array bounds allocated in the codebase.\nSuccessful exploitation of this vulnerability allows an unauthenticated attacker to corrupt adjacent heap memory by supplying a specially crafted subtitle file. This can lead to application crashes, denial of service conditions, or potentially arbitrary code execution within the context of any application utilizing FFmpeg's VobSub demuxer.\nThe attack vector requires the target application to process an untrusted VobSub subtitle file. Given FFmpeg's widespread integration into media players, transcoding pipelines, and browser components, the risk implication is high, potentially enabling remote code execution when users open maliciously crafted media files.",
  "technicalDetails": "The vulnerability is rooted in libavformat/mpeg.c, specifically within the VobSub subtitle demuxer component of FFmpeg versions 2.1 through 8.1.2. The underlying root cause is a boundary validation failure when processing subtitle streams. The demuxer relies on a fixed-size array, specifically the vobsub->q[] array, to track distinct stream IDs encountered during parsing.\nWhen an attacker supplies a malformed or maliciously crafted .sub and .idx subtitle file declaring a quantity of distinct stream IDs that exceeds the statically allocated bounds of the vobsub->q[] array, the application fails to enforce strict boundary checks. Consequently, calls to ff_subtitles_queue_insert() perform unbounded write operations beyond the designated memory boundaries of the array.\nThe step-by-step attack flow proceeds as follows: First, the victim application invokes FFmpeg's VobSub demuxer to parse a malicious input file containing excessive, out-of-bounds stream identifiers. Second, as the parser processes the file headers and index data, it maps the declared stream IDs to the internal tracking structures. Third, because the number of distinct stream IDs surpasses the fixed capacity of the vobsub->q[] structure, data is written past the allocated heap buffer.\nThis out-of-bounds heap write leads to heap memory corruption, overwriting adjacent metadata structures or function pointers residing on the heap. Depending on the memory layout and heap exploitation techniques, an attacker can leverage this primitive to hijack control flow, resulting in arbitrary code execution. The vulnerability requires no authentication or special privileges beyond convincing a target application to open the malicious media file."
}