Heap Buffer Overflow in FFmpeg DVB Subtitle Parser

FFmpeg versions ranging from 0.5 up to, but not including, 9.0 contain a critical signed integer overflow vulnerability within the DVB subtitle parser located in the libavcodec/dvbsub_parser.c source file. The vulnerability is triggered when the parser processes a maliciously crafted WTV (Windows Recorded TV) container file. During parsing, the logic responsible for bounds checking is susceptible to a signed integer overflow. Specifically, the guard expression wraps to a negative value (INT_MIN), which inadvertently bypasses the critical PARSE_BUF_SIZE comparison. This bypass leads to an unchecked memcpy() operation, resulting in an out-of-bounds heap write. Successful exploitation allows for memory corruption, which can lead to application crashes (Denial of Service) or arbitrary code execution under the context of the user running the FFmpeg-based application. Defenders should prioritize patching all internal and third-party software leveraging FFmpeg libraries to version 9.0 or later.

Impact

This vulnerability impacts any software suite or media processing pipeline that utilizes the affected versions of the FFmpeg library. Potential damage includes system compromise through arbitrary code execution or persistent service disruption via heap memory corruption. Given the prevalence of FFmpeg in media transcoders, video editors, and streaming servers, the scope of exposure is significant across multiple industry sectors.

Recommendation

• Identify all internal and vendor-supplied software packages that bundle FFmpeg versions 0.5 through 8.9 for immediate remediation.
• Update all instances of FFmpeg to version 9.0 or later to address the vulnerability in libavcodec/dvbsub_parser.c.
• Audit ingestion pipelines that process WTV file formats to restrict untrusted input sources until patches are applied.