CyberRota Analysis
AI-GeneratedFFmpeg versions from 0.5 to 9.0 are vulnerable due to a signed integer overflow in the DVB subtitle parser, which can be exploited by attackers through specially crafted WTV files. This vulnerability can lead to a heap buffer overflow, allowing for out-of-bounds writes that may result in memory corruption or arbitrary code execution. Organizations using affected FFmpeg versions, particularly those handling video processing or streaming, should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.