CVE-2026-64833

Katalog CVE

CVSS 7.1 · High EPSS 0,40%

Kerentanan Out-of-bounds Read pada ffmpeg. Skor CVSS 3.1 7.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.

Rincian

Terbit di NVD

22 Juli 2026

Terakhir diubah

12 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4 patch
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661 issue tracking · patch
• https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c advisory pihak ketiga