CVE-2026-70628: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-70628 is a signed integer overflow vulnerability in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) that enables a heap buffer overflow via a crafted WTV file. It affects FFmpeg versions from 0.5 up to, but not including, 9.0. The vulnerability was published on August 6, 2026, with a patch advisory added to the GitHub Advisory Database on August 7, 2026. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (Github Advisory, Feedly).

The root cause is a signed integer overflow (CWE-190) in the DVB subtitle parser within libavcodec/dvbsub_parser.c, which leads to an out-of-bounds write (CWE-787). When FFmpeg processes a specially crafted WTV file, an arithmetic operation on a signed integer overflows and wraps to INT_MIN, causing the bounds-check guard expression that compares against PARSE_BUF_SIZE to be bypassed. This allows memcpy() to be invoked with attacker-controlled data written into a heap buffer at an out-of-bounds offset, resulting in heap memory corruption. Exploitation requires user interaction — a victim must open or process the malicious WTV file. Three fix commits are referenced: c6ec28b, 93f2a52, and 02fc47e, associated with pull request #23897 (Github Advisory, Feedly).

Successful exploitation can result in heap memory corruption, potential information disclosure, and arbitrary code execution in the context of the FFmpeg process. All three security pillars are affected: confidentiality (memory/data exposure), integrity (unauthorized memory writes), and availability (process crash or instability). Because FFmpeg is widely embedded in media processing pipelines, video players, and server-side transcoding services, exploitation could affect a broad range of downstream applications and platforms (Github Advisory, Feedly).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.15% (5th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must process a crafted WTV file), and the attack vector is local, which limits the attack surface compared to network-exploitable vulnerabilities (Github Advisory, Feedly).

1. Craft a malicious WTV file: Create a WTV (Windows Recorded TV) file containing a DVB subtitle stream with a specially crafted subtitle data length field designed to trigger a signed integer overflow in dvbsub_parser.c.
2. Trigger integer overflow: When FFmpeg parses the DVB subtitle packet, the malformed length value causes a signed integer arithmetic operation to overflow and wrap to INT_MIN, making the bounds-check comparison against PARSE_BUF_SIZE evaluate incorrectly.
3. Bypass bounds check: With the guard expression evaluating to a negative/wrapped value, the size check is bypassed, and memcpy() is called with attacker-controlled data and an out-of-bounds destination offset into a heap buffer.
4. Achieve heap corruption: The out-of-bounds memcpy() writes attacker-controlled bytes beyond the allocated heap buffer, corrupting adjacent heap metadata or data structures.
5. Deliver the file to the victim: Distribute the crafted WTV file via email, download link, or shared storage, and social-engineer the victim into opening it with an FFmpeg-based application (e.g., a media player or transcoder).
6. Achieve code execution: Leverage the heap corruption to redirect control flow, potentially enabling arbitrary code execution in the context of the FFmpeg process (Github Advisory, Feedly).

• File System: Presence of unexpected or unsolicited .wtv files in user download directories, temp folders, or media libraries; unusual files written to disk by the FFmpeg process after processing a WTV file.
• Process: Unexpected child processes spawned by FFmpeg or an FFmpeg-based application (e.g., cmd.exe, /bin/sh, curl, wget, powershell); FFmpeg process crashing with segmentation faults or heap corruption errors when processing WTV files.
• Logs: Application crash logs or core dumps referencing dvbsub_parser.c or libavcodec; error messages indicating memory corruption or invalid memory access during WTV/DVB subtitle parsing.
• Network: Unexpected outbound network connections from media player or transcoding processes following the opening of a WTV file, which may indicate post-exploitation activity such as reverse shell or data exfiltration.

The primary remediation is to upgrade FFmpeg to version 9.0 or later, which contains fixes applied via commits c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c, 93f2a525ec6c7b467bae68322720d10188fc6e30, and 02fc47e13f903768b75f7985a2706a6223ab4506 (pull request #23897). If immediate patching is not feasible, restrict FFmpeg from processing untrusted or externally sourced WTV files, and implement input validation to reject suspicious subtitle data. Sandboxing FFmpeg processes (e.g., using containers, seccomp filters, or AppArmor/SELinux profiles) can limit the blast radius of potential code execution. Organizations using FFmpeg in server-side pipelines should prioritize patching given the broad deployment of the library (Github Advisory, Feedly).

The vulnerability was noted in the CISA vulnerability bulletin (SB26-222) and flagged by the Yocto Project security mailing list, indicating awareness in embedded Linux and open-source communities. Tenable released Nessus detection plugins (IDs 333301 and 335156) shortly after disclosure. No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability tracking and aggregation sites (Feedly).