CVE-2026-64833 FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c

🗓️ 22 Jul 2026 17:03:20Reported by VulnCheckType

FFmpeg spdifenc allows out-of-bounds reads during DTS remuxing when core_size exceeds packet length.

Reporter	Title	Published	Views	Family All 2
CVE	CVE-2026-64833	22 Jul 202617:03	–	cve
NVD	CVE-2026-64833	22 Jul 202618:17	–	nvd

[
  {
    "defaultStatus": "affected",
    "vendor": "FFmpeg",
    "product": "FFmpeg",
    "versions": [
      {
        "status": "affected",
        "version": "0.7.1",
        "versionType": "semver",
        "lessThanOrEqual": "8.1.2"
      },
      {
        "status": "affected",
        "version": "6f80e2765492700622596af720534cef33dd31b4",
        "versionType": "git"
      }
    ],
    "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg"
  }
]

Source	Link
code	www.code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661
vulncheck	www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c
code	www.code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4

22 Jul 2026 17:06Current

CVSS 47.1

CVSS 3.17.1

CWE-125