Loading story…
FFmpeg disclosed and patched CVE-2026-70628, a high-severity heap buffer overflow in the DVB subtitle parser within libavcodec/dvbsub_parser.c that affects versions 0.5 through before 9.0. The flaw stems from a signed integer overflow in a capacity check: a crafted WTV file can force the bounds-check expression to wrap to INT_MIN, bypass the PARSE_BUF_SIZE validation, and trigger an out-of-bounds heap write through memcpy(). The resulting memory corruption could potentially be leveraged for code execution when malicious media is processed.
The issue is tracked under CWE-190 and CWE-787 and was addressed through FFmpeg commits and pull request #23897, which changed avcodec/dvbsub_parser to avoid signed overflow in the capacity check. The vulnerable code path traces back to the long-standing DVB subtitle decoder implementation, indicating broad version exposure across FFmpeg deployments that ingest untrusted broadcast or recorded video content.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry, CVE-2026-70628, was received on August 6, 2026 for FFmpeg versions 0.5 through before 9.0. The record describes a signed integer overflow in libavcodec/dvbsub_parser.c where a crafted WTV file can bypass a bounds check and trigger an out-of-bounds heap write via memcpy().
FFmpeg opened pull request 23897 for "avcodec/dvbsub_parser: avoid signed overflow in the capacity check." The CVE record later referenced this pull request as part of the remediation for the vulnerability.
FFmpeg published commits 02fc47e13f903768b75f7985a2706a6223ab4506 and 93f2a525ec6c7b467bae68322720d10188fc6e30 titled "avoid signed overflow in the capacity check" for avcodec/dvbsub_parser. These commits correspond to the fix for the heap buffer overflow issue later tracked as CVE-2026-70628.
FFmpeg introduced the DVB subtitle decoder code in commit c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c. The later CVE record identifies the DVB subtitle parser in this code path as the vulnerable component.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecode.ffmpeg.org
Open sourcecode.ffmpeg.org
Open sourcecode.ffmpeg.org
Open sourcecode.ffmpeg.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-58049** affects FFmpeg’s RASC video decoder in `libavcodec/rasc.c`, where the `decode_dlta()` function performs 32-bit reads and writes before enforcing a row-boundary check. The flaw is compounded by validating the DLTA region in pixel units rather than byte units, allowing a crafted media stream using the RASC FourCC to access several bytes past a PAL8 frame row allocation. Security advisories say the bug can trigger a bitstream-controlled heap out-of-bounds write and an adjacent out-of-bounds read during decoding, leading to memory corruption and potential remote exploitation. A public proof of concept demonstrates the issue on FFmpeg upstream code and shows how DLTA run handlers can write past a 64-byte PAL8 frame row boundary. The PoC uses a custom buffer callback to place a function pointer next to the frame buffer, then overwrites the low bytes of that pointer through a crafted DLTA run to redirect execution, while AddressSanitizer reports a heap-buffer-overflow in `decode_dlta()`. Reported mitigations include updating FFmpeg, applying vendor patches, and moving row-boundary validation ahead of every 32-bit access with stricter checks such as ensuring `cx + 4 <= w * s->bpp`.
Jul 12, 2026
FFmpeg through version **8.1.2** is affected by **`CVE-2026-66039`**, a high-severity flaw in the **MACE6 audio decoder** that can be triggered with a crafted **CAF** file. The vulnerability stems from a signed integer overflow in `mace_decode_frame()` when attacker-controlled `bytes_per_packet` and `frames_per_packet` values are parsed from the file's `desc` chunk, causing the decoder to miscalculate output sample counts. The overflow can lead to an undersized heap allocation followed by a **heap out-of-bounds write**, creating a path to memory corruption and possible code execution in contexts where a user opens or processes a malicious media file. The issue is mapped to **`CWE-190`** and **`CWE-122`**, carries a **CVSS v3.1** rating of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, and was fixed in FFmpeg commit `aafb5c655edc76a753275c383ebb139feb032718`, which rejects sample counts that overflow `int`.
Jul 25, 2026
A high-severity vulnerability, **CVE-2026-70632**, was disclosed in **FFmpeg** affecting versions **4.4 through before 9.0**. The flaw is a **heap out-of-bounds write** in the native GoPro CineForm HD (**CFHD**) decoder that can be triggered when FFmpeg probes a crafted **AVI** file. The bug occurs in `cfhd_decode()` because the transform-type-2 reconstruction path does not properly enforce output-width limits for non-Bayer data, allowing `horiz_filter_clip()` to write past the allocated frame buffer.
Aug 7, 2026