CVE-2026-64830: FFmpeg Buffer Overflow Vulnerability

CVE-2026-64830 Overview

CVE-2026-64830 is a heap buffer overflow vulnerability in the FFmpeg VobSub subtitle demuxer. The flaw affects FFmpeg versions 2.1 through 8.1.2 and resides in libavformat/mpeg.c. Attackers can craft a malicious .sub/.idx subtitle file that declares more distinct stream IDs than the fixed-size vobsub->q[] array can hold. Processing the file triggers unbounded writes past the array boundary through ff_subtitles_queue_insert(), corrupting adjacent heap memory. Any application that links against FFmpeg's VobSub demuxer inherits the exposure, including media players, transcoders, and server-side video processing pipelines. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow).

Critical Impact
A crafted VobSub subtitle file can corrupt heap memory in any FFmpeg-based application, potentially leading to arbitrary code execution.

Affected Products

FFmpeg 2.1 through 8.1.2 (VobSub subtitle demuxer in libavformat/mpeg.c)
Applications and services that embed or link vulnerable FFmpeg libraries
Media processing pipelines that accept user-supplied .sub/.idx files

Discovery Timeline

2026-07-22 - CVE-2026-64830 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-64830

Vulnerability Analysis

The VobSub demuxer parses .idx index files that describe subtitle streams stored in the companion .sub file. FFmpeg allocates a fixed-size array vobsub->q[] sized to the expected number of distinct stream IDs. When the demuxer encounters new stream IDs while parsing subtitle packets, it inserts entries via ff_subtitles_queue_insert(). The code path does not bound-check the number of distinct stream IDs against the array capacity. A malicious .idx file that declares more stream IDs than the fixed capacity causes writes past the end of vobsub->q[], corrupting adjacent heap metadata and data structures.

Root Cause

The root cause is missing input validation on the count of distinct subtitle stream IDs parsed from attacker-controlled .sub/.idx files. The demuxer trusts the file-supplied stream identifiers and indexes into vobsub->q[] without verifying that the index remains within the allocated bounds. This is a classic [CWE-122] heap-based buffer overflow driven by untrusted media metadata.

Attack Vector

Exploitation requires an application using FFmpeg to open a crafted subtitle file. Delivery vectors include email attachments, downloaded video archives that bundle subtitles, hostile web content processed by a browser plugin or server-side transcoder, and cloud media processing services that accept user uploads. User interaction is typically required to open or process the file. The vulnerability manifests during demuxing, before decoding begins. Refer to the FFmpeg commit reference, FFmpeg Pull Request #23657, and the VulnCheck advisory for the corrective changes and technical write-up.

// No verified public exploit code is available.
// See vendor commit and advisory links above for technical details.

Detection Methods for CVE-2026-64830

Indicators of Compromise

.sub or .idx subtitle files declaring an unusually large number of distinct stream IDs relative to typical VobSub layouts.
Crashes, segmentation faults, or heap corruption reports originating in libavformat while processing subtitle content.
Unexpected child processes or shellcode-like memory regions spawned by media player, transcoder, or ffmpeg CLI processes.

Detection Strategies

Inventory installed FFmpeg versions across servers, workstations, and container images, and flag any build in the 2.1 through 8.1.2 range.
Inspect .idx files handled by media pipelines for stream ID counts that exceed expected VobSub norms.
Instrument media processing hosts with AddressSanitizer or heap integrity checks in test environments to surface out-of-bounds writes triggered by fuzzed subtitle inputs.

Monitoring Recommendations

Alert on abnormal termination or crash signatures from ffmpeg, ffprobe, and applications that embed libavformat.
Monitor process trees for media applications spawning shells, scripting engines, or network utilities after opening subtitle files.
Log ingestion of .sub/.idx files in server-side transcoding services and correlate with subsequent worker crashes or restarts.

How to Mitigate CVE-2026-64830

Immediate Actions Required

Identify all systems and container images running FFmpeg between versions 2.1 and 8.1.2 and prioritize upgrades.
Block or quarantine untrusted .sub and .idx subtitle uploads in media processing pipelines until patched builds are deployed.
Rebuild and redeploy applications that statically link vulnerable FFmpeg libraries after applying the upstream fix.

Patch Information

Apply the upstream FFmpeg fix referenced in commit dbd495f0 and tracked in FFmpeg Pull Request #23657. Consult the VulnCheck advisory for additional context. Downstream distribution maintainers should track backports for long-term support branches.

Workarounds

Disable the VobSub demuxer in build configurations where subtitle support is not required.
Reject .sub/.idx files from untrusted sources at the application or gateway layer.
Sandbox FFmpeg processes with seccomp, AppArmor, or containerization to limit blast radius from heap corruption.

bash

# Verify installed FFmpeg version and confirm it is patched
ffmpeg -version

# Example: disable VobSub demuxer when building FFmpeg from source
./configure --disable-demuxer=vobsub
make && make install