CyberRota Analysis
AI-GeneratedFFmpeg versions 2.1 through 8.1.2 are vulnerable to a heap buffer overflow in the VobSub subtitle demuxer, which can be exploited by attackers through specially crafted .sub/.idx subtitle files that exceed the array bounds. This vulnerability allows for arbitrary code execution by corrupting adjacent heap memory, posing a significant risk to any application utilizing FFmpeg's VobSub demuxer. Organizations using affected versions of FFmpeg should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.
Related CVEs
Other vulnerabilities affecting the same vendor(s)