Read the docs
TI-2026-46355 Aliases CVE-2026-64830GHSA-jphx-q7f7-4x8r

FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer

Priority MEDIUM 41CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00646 51st percentileScored 2026-11-07
Fix Partial Red Hat: 53 advisoriesRed Hat: 11 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FFmpegFFmpeg2.1 – 8.1.2—No fix listedCNA
  • FFmpeg VendorFFmpeg Affected 2.1 – 8.1.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*2.1 – 8.1.2VulnerableFFmpeg
  • cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* Versions 2.1 – 8.1.2 Vulnerable ·FFmpeg

Remediation

Red Hat 53 advisories

  • RHSA-2026:92452 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:92449 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Show 50 more Red Hat advisories
  • RHSA-2026:82921 Released 2026-10-14 · Red Hat rating Important
    Red Hat AI Base Images 3.2.5 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:82415 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cpu)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:82371 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (spyre)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:82368 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cuda)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:82066 Released 2026-10-13 · Red Hat rating Important
    Red Hat AI Inference Model Optimization Tools 3.5.2 (CUDA)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/model-opt-cuda-rhel9
  • RHSA-2026:82061 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference Tech Preview 3.5.2 (Gaudi)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
  • RHSA-2026:82059 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (ROCm)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:81128 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (CPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:81127 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (CUDA 12.9)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:80760 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (Spyre)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:80757 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (ROCm 7.0)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:80756 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (CUDA 13.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:80739 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:80740 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (ROCm 6.4)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:80737 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (Spyre)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:80735 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (TPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:80732 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.3.5 (CPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:76042 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (CUDA)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:75660 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Spyre)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:75659 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (ROCm 7.14)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rocm-7.14-rhel9
  • RHSA-2026:75658 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (TPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:75657 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (CUDA 13.0)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:75655 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Rubin)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rubin-rhel9
  • RHSA-2026:75654 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Neuron)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:75652 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (CPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74771 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Gaudi)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:74688 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:74687 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (ROCm 7.1)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-7.1-rhel9
  • RHSA-2026:74685 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:74683 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CUDA 13.0)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:74681 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Spyre)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74679 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (CPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74678 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Gaudi)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:74677 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (TPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:74450 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (Neuron)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:74365 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (Spyre)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74364 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (CUDA 12.9)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:74363 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (ROCm 7.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-7.0-rhel9
  • RHSA-2026:74362 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (CUDA 13.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:74361 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (ROCm 6.4)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:74360 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (TPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:74359 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.3.4 (CPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74089 Released 2026-09-30 · Red Hat rating Moderate
    RHEL AI 3.0 RPM runtime CVE fix - ffmpeg
    • Red Hat Enterprise Linux AI 3.0 for RHEL 9 ffmpeg-6.1.6-9.el9ai, ffmpeg-free-rhai-6.1.6-9.el9ai, ffmpeg-free-rhai-devel-6.1.6-9.el9ai +16
  • RHSA-2026:67303 Released 2026-09-14 · Red Hat rating Important
    RHEL AI 3.5 RPM runtime CVE fix - ffmpeg
    • Red Hat Enterprise Linux AI 3.5 for RHEL 9 ffmpeg-6.1.6-9.el9ai, ffmpeg-free-rhai-6.1.6-9.el9ai, ffmpeg-free-rhai-devel-6.1.6-9.el9ai +16
  • RHSA-2026:67309 Released 2026-09-14 · Red Hat rating Important
    RHEL AI 3.4 RPM runtime CVE fix - ffmpeg
    • Red Hat Enterprise Linux AI 3.4 for RHEL 9 ffmpeg-6.1.6-9.el9ai, ffmpeg-free-rhai-6.1.6-9.el9ai, ffmpeg-free-rhai-devel-6.1.6-9.el9ai +16
  • RHSA-2026:67276 Released 2026-09-14 · Red Hat rating Important
    RHEL AI 3.3 RPM runtime CVE fix - ffmpeg
    • Red Hat Enterprise Linux AI 3.3 for RHEL 9 ffmpeg-6.1.6-9.el9ai, ffmpeg-free-rhai-6.1.6-9.el9ai, ffmpeg-free-rhai-devel-6.1.6-9.el9ai +16
  • RHSA-2026:61629 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:61628 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:61627 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat AI Inference Server 3.2Fixed RHSA-2026:61627, RHSA-2026:61628, RHSA-2026:61629
Red Hat AI Inference Server 3.5Fixed RHSA-2026:82059, RHSA-2026:82061, RHSA-2026:82066, RHSA-2026:82368, RHSA-2026:82371, RHSA-2026:82415
Red Hat Enterprise Linux AI 3.0 for RHEL 9Fixed RHSA-2026:74089
Red Hat Enterprise Linux AI 3.3 for RHEL 9Fixed RHSA-2026:67276
Red Hat Enterprise Linux AI 3.4 for RHEL 9Fixed RHSA-2026:67309
Red Hat Enterprise Linux AI 3.5Fixed RHSA-2026:92449, RHSA-2026:92452
Red Hat Enterprise Linux AI 3.5 for RHEL 9Fixed RHSA-2026:67303
Red Hat OpenShift AI 3.2Fixed RHSA-2026:80735, RHSA-2026:80739, RHSA-2026:80740, RHSA-2026:80757, RHSA-2026:80760, RHSA-2026:81128, RHSA-2026:82921
Red Hat OpenShift AI 3.3Fixed RHSA-2026:74359, RHSA-2026:74360, RHSA-2026:74361, RHSA-2026:74362, RHSA-2026:74363, RHSA-2026:74364, RHSA-2026:74365, RHSA-2026:74450, RHSA-2026:80732, RHSA-2026:80737, RHSA-2026:80756, RHSA-2026:81127
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674, RHSA-2026:74677, RHSA-2026:74678, RHSA-2026:74679, RHSA-2026:74681, RHSA-2026:74683, RHSA-2026:74685, RHSA-2026:74687, RHSA-2026:74688, RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:74771, RHSA-2026:75652, RHSA-2026:75654, RHSA-2026:75655, RHSA-2026:75657, RHSA-2026:75658, RHSA-2026:75659, RHSA-2026:75660, RHSA-2026:76042
Not affected: 2 products
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-64830
  2. 2026-10-03 Alias added: GHSA-jphx-q7f7-4x8r
  3. 2026-10-05 Fix available: RHSA-2026:75659 · Red Hat
  4. 2026-10-05 Fix available: RHSA-2026:75660 · Red Hat
  5. 2026-10-05 Fix available: RHSA-2026:75655 · Red Hat
  6. 2026-10-05 Fix available: RHSA-2026:75657 · Red Hat
  7. 2026-10-05 Fix available: RHSA-2026:75654 · Red Hat
  8. 2026-10-05 Fix available: RHSA-2026:75652 · Red Hat
  9. 2026-10-05 Fix available: RHSA-2026:75658 · Red Hat
  10. 2026-10-05 Affected versions changed · Red Hat
  11. 2026-10-06 Fix available: RHSA-2026:76042 · Red Hat
  12. 2026-10-06 Affected versions changed · Red Hat
  13. 2026-10-13 Fix available: RHSA-2026:82066 · Red Hat
  14. 2026-10-13 Fix available: RHSA-2026:80735 · Red Hat
  15. 2026-10-13 Fix available: RHSA-2026:80732 · Red Hat
  16. 2026-10-13 Fix available: RHSA-2026:80739 · Red Hat
  17. 2026-10-13 Fix available: RHSA-2026:80737 · Red Hat
  18. 2026-10-13 Fix available: RHSA-2026:80740 · Red Hat
  19. 2026-10-13 Fix available: RHSA-2026:80757 · Red Hat
  20. 2026-10-13 Fix available: RHSA-2026:80756 · Red Hat
  21. 2026-10-13 Fix available: RHSA-2026:80760 · Red Hat
  22. 2026-10-13 Fix available: RHSA-2026:81127 · Red Hat
  23. 2026-10-13 Fix available: RHSA-2026:81128 · Red Hat
  24. 2026-10-13 Fix available: RHSA-2026:82061 · Red Hat
  25. 2026-10-13 Fix available: RHSA-2026:82059 · Red Hat
  26. 2026-10-13 Fix available: Red Hat AI Inference Server 3.5, Red Hat OpenShift AI 3.2 · Red Hat
  27. 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
  28. 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
  29. 2026-10-14 Fix available: RHSA-2026:82371 · Red Hat
  30. 2026-10-15 Fix available: RHSA-2026:82921 · Red Hat
  31. 2026-10-16 Affected versions changed · Red Hat
  32. 2026-10-20 EPSS moved to the 50th–90th percentile
  33. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  34. 2026-10-20 Affected versions changed · Red Hat
  35. 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
  36. 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
  37. 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat

References

Patch 2

  • TI-2025-19015 FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c. CVSS 3.1HIGH 8.8
  • TI-2024-21238 FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column. CVSS 3.1HIGH 8.4
  • TI-2023-06050 Ffmpeg: null pointer dereference in ffmpeg hls parsing CVSS 3.1HIGH 7.5
  • TI-2023-28420 Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to… CVSS 3.1HIGH 8.0
  • TI-2023-27357 FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the… CVSS 3.1HIGH 8.0
  • TI-2023-27044 Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local… CVSS 3.1HIGH 8.0
See all 514 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences