CVE-2026-64833
Received Received - Intake

Out-of-Bounds Read in FFmpeg S/PDIF Muxer

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: VulnCheck

Description
FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-64833
EUVD
EUVD-2026-47757

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ffmpeg ffmpeg From 0.7.1 (inc) to 8.1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds read vulnerability in FFmpeg versions 0.7.1 through 8.1.2 affecting the S/PDIF muxer. It occurs when processing a crafted DTS stream with a core_size value larger than the actual packet length. The missing bounds check in the spdif_header_dts4 function allows attackers to read memory beyond the intended buffer during S/PDIF re-muxing of malicious DTS-HD audio streams.

Detection Guidance

Detecting this vulnerability requires analyzing FFmpeg versions and examining audio streams. Check FFmpeg version with 'ffmpeg -version' and look for versions between 0.7.1 and 8.1.2. Monitor network traffic for unusual DTS-HD audio streams during S/PDIF re-muxing operations.

Impact Analysis

An attacker could exploit this to read sensitive memory contents, potentially exposing confidential data or causing crashes. Systems processing untrusted DTS-HD audio streams via FFmpeg are at risk of unauthorized memory access.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical memory access issue rather than a data protection or privacy breach. However, unauthorized memory access could potentially lead to data leaks or system instability, which might indirectly impact compliance if sensitive data is exposed or systems fail to meet operational requirements.

Mitigation Strategies

Immediately upgrade FFmpeg to version 8.1.3 or later. Avoid processing untrusted DTS-HD audio streams in S/PDIF muxing contexts. Implement input validation for audio streams and monitor for memory corruption errors in FFmpeg logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64833. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart