CVE-2026-64833

EUVD-2026-47757

22.07.2026, 18:17

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.1 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 32.78%

Affected Products (NVD)

Vendor	Product	Version
ffmpeg	ffmpeg	0.7.1 ≤ 𝑥 ≤ 8.1.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	vulnerable
bookworm (security)	vulnerable
bullseye	vulnerable
bullseye (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	postponed
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

bionic	Fixed 7:3.4.11-0ubuntu0.1+esm15 released
focal	Fixed 7:4.2.7-0ubuntu0.1+esm16 released
jammy	Fixed 7:4.4.2-0ubuntu0.22.04.1+esm15 released
noble	Fixed 7:6.1.1-3ubuntu5+esm13 released
resolute	needed
xenial	Fixed 7:2.8.17-0ubuntu0.1+esm17 released

libav

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libavcodec-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavcodec57

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavformat-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavformat57

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavresample3

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil55

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libpostproc-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libpostproc54

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswresample2

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswscale-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswscale4

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

Common Weakness Enumeration

CWE-125 - Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer.

Vulnerability Media Exposure

[GERMAN] ffmpeg: Mehrere Schwachstellen
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ffmpeg ausnutzen, um beliebigen Code auszuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.
Published: 2026-07-22T22:00:00+00:00

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661

https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c