CVE-2026-64830

EUVD-2026-47747

22.07.2026, 17:16

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 49.84%

Affected Products (NVD)

Vendor	Product	Version
ffmpeg	ffmpeg	2.1 ≤ 𝑥 ≤ 8.1.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	vulnerable
bookworm (security)	vulnerable
forky	7:9.0.2-1 fixed
sid	7:9.0.2-2 fixed
trixie	postponed
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

bionic	Fixed 7:3.4.11-0ubuntu0.1+esm15 released
focal	Fixed 7:4.2.7-0ubuntu0.1+esm16 released
jammy	Fixed 7:4.4.2-0ubuntu0.22.04.1+esm15 released
noble	Fixed 7:6.1.1-3ubuntu5+esm13 released
resolute	Fixed 7:8.0.1-3ubuntu2+esm4 released
xenial	Fixed 7:2.8.17-0ubuntu0.1+esm17 released

libav

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libavcodec-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.73.1 fixed

libavcodec57

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libavcodec58_134

suse enterprise desktop 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.52.1 fixed

libavformat-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.73.1 fixed

libavformat57

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.73.1 fixed

libavformat58_76

suse enterprise desktop 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.52.1 fixed

libavresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.73.1 fixed

libavresample3

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.73.1 fixed

libavutil-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libavutil55

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libavutil56_70

suse enterprise desktop 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.52.1 fixed

libpostproc-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libpostproc54

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libpostproc55_9

suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed

libswresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libswresample2

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libswresample3_9

suse enterprise desktop 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.52.1 fixed

libswscale-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libswscale4

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libswscale5_9

suse enterprise desktop 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.52.1 fixed

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657

https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer