CVE-2026-70628

Name of the Vulnerable Software and Affected Versions FFmpeg versions 0.5 through 8.x

Description A signed integer overflow exists in the DVB subtitle parser within libavcodec/dvbsub parser.c. An attacker can trigger a heap buffer overflow by providing a specially crafted WTV file. This occurs when a bounds-check guard expression wraps to INT MIN, bypassing the PARSE BUF SIZE comparison. Consequently, the memcpy() function is called with attacker-controlled data, leading to an out-of-bounds heap write, which may result in memory corruption or arbitrary code execution.

Recommendations Update FFmpeg to version 9.0 or later.