CVE-2026-64833: FFmpeg Buffer Overflow Vulnerability

CVE-2026-64833 Overview

CVE-2026-64833 is an out-of-bounds read vulnerability in the FFmpeg S/PDIF muxer, affecting versions 0.7.1 through 8.1.2. The flaw resides in the spdif_header_dts4 function within spdifenc.c, where a missing bounds check allows a crafted DTS-HD audio stream to trigger memory reads past the packet buffer. An attacker supplies a malicious DTS stream containing a core_size value larger than the actual packet length. During S/PDIF re-muxing, FFmpeg reads memory beyond the buffer boundary, exposing adjacent memory contents or causing process instability.

Critical Impact
Attackers can trigger out-of-bounds memory reads during DTS-HD to S/PDIF re-muxing, causing information disclosure or denial of service in applications and pipelines that process untrusted audio streams with FFmpeg.

Affected Products

FFmpeg versions 0.7.1 through 8.1.2
Applications and services embedding vulnerable FFmpeg libraries for audio muxing
Media processing pipelines performing DTS-HD to S/PDIF re-muxing

Discovery Timeline

2026-07-22 - CVE-2026-64833 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-64833

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in the S/PDIF muxer component of FFmpeg. The spdif_header_dts4 function processes DTS-HD audio frames during S/PDIF encapsulation. The function reads a core_size value from the input DTS stream header and uses it to determine how many bytes to process from the packet buffer.

FFmpeg does not validate that core_size fits within the actual packet length before dereferencing the buffer. When an attacker sets core_size to a value larger than the packet size, the muxer reads memory beyond the allocated packet buffer. This exposes adjacent heap contents to subsequent processing stages or terminates the process through a segmentation fault.

The fix landed in FFmpeg commit 6f80e2765492700622596af720534cef33dd31b4, which introduces the missing size validation before the buffer access. Additional context is available in the FFmpeg Pull Request Discussion and the VulnCheck Advisory on FFmpeg.

Root Cause

The root cause is a missing bounds check in spdif_header_dts4. The function trusts the attacker-controlled core_size field from the DTS-HD stream header without comparing it against the true packet buffer length before performing the read.

Attack Vector

Exploitation requires an attacker to supply a crafted DTS-HD audio stream to a target that performs S/PDIF re-muxing with FFmpeg. This is typically achieved through media upload endpoints, transcoding services, or client-side media players. User interaction is required to open or process the malicious file. See the FFmpeg Commit Details for the patched code path.

No verified exploit code is publicly available.
See the FFmpeg commit and VulnCheck advisory for technical details.

Detection Methods for CVE-2026-64833

Indicators of Compromise

FFmpeg process crashes or unexpected termination during DTS or DTS-HD stream processing
Segmentation faults logged from applications invoking libavformat for S/PDIF muxing
Malformed DTS-HD audio files with core_size values exceeding declared packet lengths
Anomalous memory read patterns in transcoding services handling user-supplied media

Detection Strategies

Inventory all systems running FFmpeg versions between 0.7.1 and 8.1.2, including embedded and third-party applications that bundle FFmpeg libraries.
Inspect media processing logs for repeated libavformat crashes or errors tied to spdifenc.c.
Deploy file-format validation on media ingestion endpoints to identify DTS streams containing inconsistent core_size fields.

Monitoring Recommendations

Monitor transcoding and media pipeline services for abnormal exit codes and core dumps.
Track outbound network activity from media processing hosts to identify secondary payloads staged after a crash.
Alert on unusual volumes of failed muxing operations, which may indicate exploitation attempts against public-facing services.

How to Mitigate CVE-2026-64833

Immediate Actions Required

Upgrade FFmpeg to a version containing commit 6f80e2765492700622596af720534cef33dd31b4 or later.
Audit downstream applications and container images for bundled FFmpeg binaries in the vulnerable range.
Restrict acceptance of DTS-HD content on media ingestion endpoints until patched builds are deployed.

Patch Information

The upstream fix is available in the FFmpeg Commit Details. The patch adds the missing bounds check in spdif_header_dts4 so that core_size cannot exceed the actual packet length. Rebuild any statically linked applications after upgrading. Review the VulnCheck Advisory on FFmpeg for vendor-specific guidance.

Workarounds

Disable S/PDIF muxing paths in FFmpeg-based workflows where they are not required.
Reject DTS and DTS-HD input formats at ingestion gateways until patched FFmpeg builds are in place.
Run FFmpeg inside sandboxed or seccomp-restricted containers to contain the impact of out-of-bounds reads.

bash

# Verify the installed FFmpeg version and remove vulnerable builds
ffmpeg -version | head -n 1

# Example: rebuild from patched source
git clone https://code.ffmpeg.org/FFmpeg/FFmpeg.git
cd FFmpeg
git checkout 6f80e2765492700622596af720534cef33dd31b4
./configure && make && sudo make install