CVE-2026-64833: ffmpeg from 0.7.1 (inclusive), through 8.1.2 (inclusive); +1 more affected products

Affected technology

ffmpeg · from 0.7.1 (inclusive), through 8.1.2 (inclusive)
ffmpeg

FFmpeg · 0.7.1 through 8.1.2, 6f80e2765492700622596af720534cef33dd31b4
FFmpeg

Description’s affected range: versions 0.7.1 through 8.1.2

Component: Not specified by the source
Function: by

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as low; integrity impact as none; availability impact as high.