CVE-2026-64830

Name of the Vulnerable Software and Affected Versions FFmpeg versions 2.1 through 8.1.2

Description A heap buffer overflow exists in the VobSub subtitle demuxer. An attacker can corrupt adjacent heap memory by providing a malicious .sub/.idx subtitle file that declares more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. This allows unbounded writes beyond the vobsub->q[] array boundary through the ff subtitles queue insert() function, which could lead to arbitrary code execution in applications utilizing the VobSub demuxer.

Recommendations Update FFmpeg to a version later than 8.1.2. As a temporary workaround, avoid processing untrusted .sub/.idx subtitle files using the VobSub demuxer.