Skip to content

CVE-2026-64830 on CTRL-OS 26.05

Aliases: CVE-2026-64830

Packages: ffmpeg

Status: Plausible

Advisory Information

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.

Updates

2026-08-01 00:05 CEST

Metadata changes:

  • Status for package ffmpeg: “Plausible”

(Amended on: 2026-08-01 00:06 CEST)

2026-07-31 00:58 CEST

Metadata changes:

  • Status for package ffmpeg: “New”