CVE-2026-70628Disclosure(ffmpeg / ffmpeg)

LOWCVSS 8.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.

ffmpeg CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-190CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ffmpeg

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
General: 1 classified signal
2 total mentions across 1 day

Affected systems

Vendors

ffmpeg

Products

ffmpeg

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets1 URL

By indicator

https://nvd.nist.gov/vuln/detail/CVE-2026-70628

Full discourse2 posts

Mohi@disismohi46d
Disclosure
If your stack processes video, you're probably running vulnerable FFmpeg right now. CVE-2026-70628: signed integer overflow in DVB subtitle parser. Heap buffer overflow. Potential RCE via crafted WTV file. Here's what to check Friday.
Post summary
The post discloses that FFmpeg contains a signed integer overflow leading to a heap buffer overflow in the DVB subtitle parser, which could allow remote code execution via crafted WTV files; no PoC, exploit, or patch is mentioned.
1000083
74 followersView on X
Mohi@disismohi46d
General
FFmpeg is in your stack even if you don't know it. Check your container base images, your CDN config, your API dependencies. This CVE should scare you more than it probably does. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-70628
Post summary
The post references a CVE in FFmpeg but provides no additional technical details, PoC, or evidence of exploitation.
0000049
74 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ffmpeg	ffmpeg	-	-	-

Explore more

Back to dashboard ffmpeg CVEs ffmpeg vulnerabilities