🚨High - FFmpeg Heap Buffer Overflow in VobSub Subtitle Demuxer (CVE-2026-64830) FFmpeg 2.1 through 8.1.2 contains a heap buffer overflow in the VobSub subtitle demuxer. A malicious .sub/.idx subtitle file that declares more distinct stream IDs than the fixed-size array in libavformat/mpeg.c triggers unbounded writes past the vobsub->q[] boundary via ff_subtitles_queue_insert(). The result is heap corruption and potentially arbitrary code execution in any application that uses FFmpeg's VobSub demuxer - media players, transcoders, and server-side media-processing pipelines. Exploitation requires processing an attacker-supplied subtitle file. CVSS 8.7. 👉Update FFmpeg to the release containing fix commit dbd495f (PR #23657).
Post summary
The post highlights a heap buffer overflow (CVE‑2026‑64830) in FFmpeg's VobSub demuxer, gives a CVSS score of 8.7, and provides a specific fix commit, indicating a patch‑focused notice.