A heap-based buffer overflow in the FFmpeg VOBSUB demuxer creates a critical risk of memory corruption and potential remote code execution.

This is a heap-based buffer overflow (CWE-122) within the VOBSUB subtitle demuxer. The attacker is unauthenticated and relies on user interaction to process a malformed subtitle file to trigger the overflow.

The vulnerability carries a CVSS score of 8.8, reflecting the significant threat of remote code execution. Successful exploitation could lead to full system compromise or service disruption, impacting the integrity and availability of platforms that utilize the FFmpeg library for video playback or processing.

Immediate Action: Track the FFmpeg repository for the inclusion of the fix in commit dbd495f066a85ba96b17433f4306582aa37c3951 and update affected software as soon as a patch is released.

Proactive Monitoring: Implement logging for subtitle processing services to detect unusual input patterns or repeated crashes when handling media.

Compensating Controls: Where possible, disable subtitle processing or restrict the use of the VOBSUB format until the underlying library can be updated.

Public Exploit Available: Unknown

Organizations should treat this vulnerability with high urgency. Patching is the only reliable way to eliminate this risk, and teams should ensure they have a clear path to update all instances of FFmpeg once the vendor provides the necessary software release.