Executive brief
FFmpeg, a widely used multimedia framework for processing audio and video, contains a flaw in how it handles certain digital audio streams. An attacker could provide a specially crafted audio file that causes the software to read memory outside of its intended area, potentially leading to a program crash or the exposure of sensitive information. This affects applications and services that use FFmpeg to process or convert audio for S/PDIF digital interfaces.
Technical details
An out-of-bounds read vulnerability exists in the FFmpeg S/PDIF muxer (spdifenc.c) within the spdif_header_dts4 function. The root cause is a missing bounds check where a 'core_size' value from a DTS stream header is trusted even if it exceeds the actual packet length. An attacker can exploit this by providing a malicious DTS-HD audio stream during S/PDIF re-muxing, causing a memcpy operation to read beyond the allocated packet buffer. This can result in a denial of service (crash) or information disclosure. The issue has been addressed in the FFmpeg master branch via commit 6f80e27654.
Affected products
- FFmpeg FFmpeg 0.7.1 through 8.1.2
Timeline
- 2026-06-30: patched: Fix committed to FFmpeg master branch
- 2026-07-22: disclosed: CVE-2026-64833 published