CVE-2026-6385: FFmpeg DVD Subtitle Parser DoS Vulnerability

CVE-2026-6385 Overview

A signed integer overflow vulnerability has been discovered in FFmpeg's DVD subtitle parser. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.

Critical Impact

Attackers can crash applications processing malicious media files, with potential for arbitrary code execution through heap memory corruption.

Affected Products

• FFmpeg (all versions with DVD subtitle parsing capability)
• Applications and services utilizing FFmpeg for media processing
• Systems processing untrusted MPEG-PS/VOB media files

Discovery Timeline

• 2026-04-15 - CVE CVE-2026-6385 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-6385

Vulnerability Analysis

This vulnerability affects FFmpeg's DVD subtitle parsing functionality, specifically within the fragment reassembly logic. The flaw stems from CWE-190 (Integer Overflow or Wraparound), where signed integer arithmetic used in bounds checking operations can overflow when processing maliciously crafted subtitle stream fragments.

When FFmpeg processes DVD subtitle data embedded in MPEG-PS/VOB container files, it performs fragment reassembly to reconstruct complete subtitle frames. The bounds checking logic that validates fragment sizes and offsets uses signed integer arithmetic. An attacker can craft a subtitle stream with carefully calculated fragment parameters that cause these signed integers to overflow, resulting in the bounds checks being bypassed.

Once the bounds validation is circumvented, the parser writes subtitle data beyond the allocated heap buffer boundaries. This heap out-of-bounds write condition can corrupt adjacent memory structures, leading to application crashes (denial of service) or potentially enabling arbitrary code execution if an attacker can control the overwritten memory contents.

Root Cause

The root cause is a signed integer overflow vulnerability (CWE-190) in the DVD subtitle parser's fragment reassembly bounds checks. When calculating buffer boundaries and offsets, signed integer arithmetic is used without proper overflow detection. Attackers can supply subtitle fragment parameters that cause these calculations to wrap around, producing small or negative values that pass validation checks but result in writes outside the intended buffer region.

Attack Vector

The attack is network-based and requires user interaction. An attacker must convince a victim to open or process a maliciously crafted MPEG-PS/VOB media file containing the specially crafted DVD subtitle stream. This can occur through:

• Downloading and playing malicious media files
• Processing untrusted media through FFmpeg-based transcoding services
• Embedding malicious media in web content or applications

The vulnerability occurs during the parsing phase, meaning any application that uses FFmpeg to decode or transcode media containing DVD subtitles is potentially affected. The attacker crafts subtitle fragment headers with values designed to trigger the integer overflow during bounds calculation, causing subsequent heap corruption when fragment data is copied.

Detection Methods for CVE-2026-6385

Indicators of Compromise

• Unexpected crashes in FFmpeg or applications using FFmpeg libraries when processing MPEG-PS/VOB files
• Application crash dumps showing heap corruption in DVD subtitle parsing functions
• Anomalous MPEG-PS/VOB files with unusual subtitle stream parameters
• Memory access violations during media file processing operations

Detection Strategies

• Monitor for application crashes or segmentation faults in media processing workflows
• Implement file integrity validation for media files before processing
• Deploy application-level monitoring to detect unusual memory allocation patterns during media decoding
• Use static analysis tools to identify potentially vulnerable FFmpeg deployments

Monitoring Recommendations

• Enable crash reporting and logging for all FFmpeg-based media processing services
• Monitor system logs for signs of heap corruption or memory access violations
• Implement network traffic analysis to identify potentially malicious media file transfers
• Review media processing service availability metrics for anomalous downtime patterns

How to Mitigate CVE-2026-6385

Immediate Actions Required

• Review all systems and applications utilizing FFmpeg for DVD subtitle processing capabilities
• Consider disabling DVD subtitle parsing if not required for operational needs
• Implement input validation to reject suspicious MPEG-PS/VOB files from untrusted sources
• Deploy network-level controls to filter potentially malicious media files

Patch Information

Consult the Red Hat CVE-2026-6385 Advisory and Red Hat Bugzilla Report #2458764 for the latest patch information and vendor guidance. Organizations should monitor FFmpeg security announcements for updated versions that address this vulnerability.

Workarounds

• Disable DVD subtitle processing in FFmpeg configurations where subtitle decoding is not required
• Implement strict input validation to only process media files from trusted sources
• Deploy sandboxing or containerization for media processing workloads to limit potential impact
• Configure resource limits and crash isolation for FFmpeg processes to prevent cascading failures