Description

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-06T22:18:26.957Z",
  "pubdate": "2026-08-06T22:18:26.957Z",
  "executiveSummary": "A signed integer overflow vulnerability exists in the DVB subtitle parser of FFmpeg within the libavcodec/dvbsub_parser.c file.\nThe vulnerability allows an unauthenticated attacker to trigger a heap buffer overflow by supplying a maliciously crafted WTV file to systems processing untrusted media.\nSuccessful exploitation can result in out-of-bounds heap writes, leading to potential memory corruption or arbitrary code execution within the context of the running application.\nAffected products include FFmpeg versions from 0.5 up to, but not including, 9.0.\nThe risk implications are severe due to the potential for remote code execution upon processing crafted media streams.\nExploitation requires the victim or an automated system to process a specifically crafted WTV file containing malicious DVB subtitle data.",
  "technicalDetails": "The root cause of the vulnerability resides in a signed integer arithmetic operation within the DVB subtitle parser implemented in libavcodec/dvbsub_parser.c.\nWhen processing a crafted WTV file, specific values supplied within the input stream cause a signed integer overflow.\nThis overflow forces the bounds-check guard expression to wrap around to INT_MIN.\nConsequently, the wrapping bypasses the critical PARSE_BUF_SIZE comparison designed to prevent buffer overflows.\nBypassing this safety check leads directly to the invocation of memcpy() with attacker-controlled data into a fixed-size heap buffer, resulting in a heap buffer overflow and out-of-bounds heap write.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious WTV file embedding manipulated DVB subtitle payload data designed to trigger the signed integer overflow during parsing. Second, the target application utilizes the vulnerable FFmpeg library to parse the input file. Third, the arithmetic operation overflows, invalidating the bounds-check guard expression. Fourth, the oversized data is copied via memcpy() into the heap buffer, corrupting adjacent heap metadata or application memory structures.\nVulnerable component: libavcodec/dvbsub_parser.c in FFmpeg.\nAffected versions: FFmpeg versions from 0.5 up to, but not including, 9.0.\nAuthentication requirements: None.\nPrivilege requirements: None.\nNetwork exposure: Local or remote, depending on how the FFmpeg library is integrated into network-facing media processing services.\nPost-exploitation impact includes application crashes via denial of service, memory corruption, and potential arbitrary code execution."
}