CVE-2026-64833

EUVD-2026-47757

22.07.2026, 18:17

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.1 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 32.14%

Affected Products (NVD)

Vendor	Product	Version
ffmpeg	ffmpeg	0.7.1 ≤ 𝑥 ≤ 8.1.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	vulnerable
bookworm (security)	vulnerable
forky	7:9.0.2-1 fixed
sid	7:9.0.2-2 fixed
trixie	postponed
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

bionic	Fixed 7:3.4.11-0ubuntu0.1+esm15 released
focal	Fixed 7:4.2.7-0ubuntu0.1+esm16 released
jammy	Fixed 7:4.4.2-0ubuntu0.22.04.1+esm15 released
noble	Fixed 7:6.1.1-3ubuntu5+esm13 released
resolute	Fixed 7:8.0.1-3ubuntu2+esm4 released
xenial	Fixed 7:2.8.17-0ubuntu0.1+esm17 released

libav

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libavcodec-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavcodec57

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavcodec58_134

suse enterprise desktop 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.55.1 fixed

libavformat-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavformat57

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavformat58_76

suse enterprise desktop 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.55.1 fixed

libavresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavresample3

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil55

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil56_70

suse enterprise desktop 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.55.1 fixed

libpostproc-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libpostproc54

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libpostproc55_9

suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed

libswresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswresample2

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswresample3_9

suse enterprise desktop 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.55.1 fixed

libswscale-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswscale4

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswscale5_9

suse enterprise desktop 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.55.1 fixed

Common Weakness Enumeration

CWE-125 - Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer.

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661

https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c