CVE-2026-64830 FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer
Attackers can achieve arbitrary code execution by supplying a malicious VobSub subtitle file to applications using the FFmpeg library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-64830?
CVE-2026-64830 is a high-severity memory corruption vulnerability in Ffmpeg Ffmpeg, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.
Weakness: CWE-122
Which versions are affected by CVE-2026-64830?
It affects 1 product.
Linux distribution packages (40)
ffmpeg Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
ffmpeg-debuginfo Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
ffmpeg-debugsource Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
ffmpeg-free-rhai Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
ffmpeg-free-rhai-debuginfo Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
ffmpeg-free-rhai-devel Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavcodec-free-rhai Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavcodec-free-rhai-debuginfo Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavcodec-free-rhai-devel Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavdevice-free-rhai Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavdevice-free-rhai-debuginfo Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavdevice-free-rhai-devel Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavfilter-free-rhai Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavfilter-free-rhai-debuginfo Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavfilter-free-rhai-devel Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavformat-free-rhai Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavformat-free-rhai-debuginfo Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavformat-free-rhai-devel Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavutil-free-rhai Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavutil-free-rhai-debuginfo Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libavutil-free-rhai-devel Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libpostproc-free-rhai Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libpostproc-free-rhai-debuginfo Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libpostproc-free-rhai-devel Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libswresample-free-rhai Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libswresample-free-rhai-debuginfo Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libswresample-free-rhai-devel Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libswscale-free-rhai Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libswscale-free-rhai-debuginfo Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
libswscale-free-rhai-devel Red Hat:enterprise_linux_ai:3.3::el9 | All versions | 0:6.1.6-9.el9ai |
ffmpeg Red Hat:enterprise_linux_ai:3.4::el9 | All versions | 0:6.1.6-9.el9ai |
ffmpeg-debuginfo Red Hat:enterprise_linux_ai:3.4::el9 | All versions | 0:6.1.6-9.el9ai |
ffmpeg-debugsource Red Hat:enterprise_linux_ai:3.4::el9 | All versions | 0:6.1.6-9.el9ai |
ffmpeg-free-rhai Red Hat:enterprise_linux_ai:3.4::el9 | All versions | 0:6.1.6-9.el9ai |
ffmpeg-free-rhai-debuginfo Red Hat:enterprise_linux_ai:3.4::el9 | All versions | 0:6.1.6-9.el9ai |
ffmpeg-free-rhai-devel Red Hat:enterprise_linux_ai:3.4::el9 | All versions | 0:6.1.6-9.el9ai |
libavcodec-free-rhai Red Hat:enterprise_linux_ai:3.4::el9 | All versions | 0:6.1.6-9.el9ai |
libavcodec-free-rhai-debuginfo Red Hat:enterprise_linux_ai:3.4::el9 | All versions | 0:6.1.6-9.el9ai |
libavcodec-free-rhai-devel Red Hat:enterprise_linux_ai:3.4::el9 | All versions | 0:6.1.6-9.el9ai |
libavdevice-free-rhai Red Hat:enterprise_linux_ai:3.4::el9 | All versions | 0:6.1.6-9.el9ai |
Products include Ffmpeg Ffmpeg.
How do I fix CVE-2026-64830?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64830 being exploited?
There is no known exploitation of CVE-2026-64830 in the wild and no public exploit code.
Other vulnerabilities in Ffmpeg Ffmpeg
Sources
Also known as DEBIAN-CVE-2026-64830, ECHO-f134-a339-73a5, GHSA-jphx-q7f7-4x8r, JLSEC-2026-1172, MINI-pj54-f4w7-v7f7, RHSA-2026:67276 and 3 more.