FFmpeg vulnerabilities

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer. An attacker can supply a crafted DTS stream with a core_size larger than the actual packet length, causing unauthorized memory reads.

A double-free vulnerability in the NVIDIA NVDEC hardware decoder in FFmpeg versions 4.4 through 8.1.2. Attackers can trigger memory corruption by supplying a crafted video file, causing a double-free of the decoder context.

In FFmpeg versions 8.0 through 8.1.2, a stack buffer overflow vulnerability exists in the Vulkan HEVC hardware decoder. A remote attacker can supply a crafted HEVC/H.265 bitstream with a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS, causing overflow of stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.

FFmpeg versions 2.1 through 8.1.2 contain a heap buffer overflow vulnerability in the VobSub subtitle demuxer. Supplying a malicious .sub/.idx file with excessive stream IDs can cause out-of-bounds writes and potential code execution.

An out-of-bounds read vulnerability in FFmpeg within Google Chrome prior to version 150.0.7871.47 allows a remote attacker to read sensitive information from process memory by crafting a malicious video file.

FFmpeg's RASC video decoder performs 32-bit reads/writes before row-boundary checks and validates DLTA region in pixels instead of bytes. A crafted RASC stream can cause out-of-bounds heap write and read, leading to memory corruption.

Vulnerability in FFmpeg's libavcodec library, in the MagicYUV decoder, causing an out-of-bounds write. This can lead to denial of service and, in some cases, remote code execution.