Description

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-07-22T18:17:05.627Z",
  "pubdate": "2026-07-22T18:17:05.627Z",
  "executiveSummary": "An out-of-bounds read vulnerability has been identified within the S/PDIF muxer of FFmpeg versions 0.7.1 through 8.1.2. This security flaw stems from an absent bounds check within the spdif_header_dts4 function, which processes DTS-HD audio streams during S/PDIF re-muxing operations.\nThe vulnerability allows an unauthenticated attacker to supply a crafted DTS stream containing a maliciously manipulated core_size parameter that exceeds the actual underlying packet length. When processed, this discrepancy forces the application to read memory regions situated strictly beyond the allocated buffer boundaries.\nSuccessful exploitation of this vulnerability can lead to unauthorized memory disclosure, potentially exposing sensitive data resident in adjacent memory spaces. The risk implications encompass information leakage, which may facilitate subsequent exploitation phases or compromise internal memory layouts.\nExploitation requires the victim or an automated process to handle a maliciously crafted DTS-HD audio stream using the vulnerable FFmpeg S/PDIF muxer component. No specific elevated privileges or pre-existing authentication mechanisms are required beyond the ability to supply the malicious input file or stream to the vulnerable software.",
  "technicalDetails": "The root cause of the vulnerability resides in the spdif_header_dts4 function located within the FFmpeg S/PDIF muxer component. This function fails to adequately validate the core_size value declared in the incoming DTS-HD audio stream headers against the true size of the allocated packet buffer.\nThe vulnerable component handles DTS and DTS-HD audio packets during the S/PDIF re-muxing process. When an attacker crafts a malicious DTS stream, they set the core_size field to a numerical value significantly larger than the actual packet length provided in the payload.\nBecause the spdif_header_dts4 function lacks the necessary defensive bounds checking, it trusts the inflated core_size value and proceeds to read memory up to that specified length. This mismatch bypasses standard buffer limits, resulting in an out-of-bounds read condition.\nThe attack flow proceeds as follows: 1) The attacker generates a malicious DTS-HD audio stream with an inflated core_size parameter. 2) The target application utilizes FFmpeg to process, convert, or re-mux the malicious audio stream through the S/PDIF muxer. 3) The spdif_header_dts4 function processes the stream and reads memory beyond the valid packet boundary based on the untrusted core_size value. 4) The operation triggers an unauthorized memory read, which may expose adjacent heap or stack data depending on how the application handles the resulting output stream.\nAffected software includes FFmpeg versions 0.7.1 through 8.1.2. The vulnerability manifests locally or wherever untrusted media streams are parsed or re-muxed by the affected library versions. No authentication or elevated privileges are required to supply the malformed input file, making it accessible to any context capable of feeding malicious multimedia data into the parser."
}