CVE-2026-64833 in FFmpeg
Summary
by MITRE • 07/22/2026
FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within the FFmpeg multimedia framework's S/PDIF muxer component and represents a critical out-of-bounds read flaw that can be exploited through improper input validation. The issue manifests when processing DTS-HD audio streams during re-muxing operations, specifically in the spdif_header_dts4 function where insufficient bounds checking allows malicious input to access memory regions beyond allocated buffer boundaries. The vulnerability affects all FFmpeg versions from 0.7.1 through 8.1.2, creating a substantial attack surface across multiple generations of this widely-used multimedia processing library.
The technical exploitation occurs when an attacker provides a crafted DTS stream containing a core_size value that exceeds the actual packet length, bypassing essential validation mechanisms that should prevent such buffer over-read conditions. This flaw directly relates to CWE-125 which defines out-of-bounds read vulnerabilities as a fundamental memory safety issue where programs access memory locations beyond the intended buffer limits. The vulnerability leverages the absence of proper input sanitization in the S/PDIF muxer's handling of DTS-HD audio streams, enabling attackers to potentially read sensitive data from adjacent memory regions including stack contents, heap data, or other process memory segments.
From an operational perspective, this vulnerability poses significant risks to systems processing multimedia content, particularly those handling DTS-HD audio streams in professional and consumer environments. The impact extends beyond simple information disclosure as unauthorized memory reads can potentially expose cryptographic keys, authentication tokens, or other sensitive application data depending on memory layout and process context. Attackers could exploit this weakness in streaming applications, media servers, or content processing systems where FFmpeg is integrated, potentially leading to privilege escalation or further exploitation through information leakage that could aid in advanced attack vectors.
Security mitigations for this vulnerability should focus on immediate version upgrades to FFmpeg 8.1.3 or later releases which contain the necessary bounds checking patches. Organizations should implement input validation controls at application layers that process DTS streams, particularly in scenarios involving third-party media content processing. The remediation aligns with ATT&CK technique T1059.007 for command and scripting interpreter while also addressing defense evasion patterns through proper buffer management. Additional protective measures include implementing memory safety mechanisms such as address space layout randomization, stack canaries, and heap metadata protection to limit the impact of potential exploitation attempts, though the primary solution remains the application of official security patches that address the core bounds checking deficiency in the spdif_header_dts4 function.