CVE-2026-6385 PUBLISHED

Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser

Assigner: redhat
Reserved: 15.04.2026 Published: 15.04.2026 Updated: 15.04.2026

A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Product Status

Vendor Red Hat
Product Lightspeed Core
Versions Default: affected
Vendor Red Hat
Product Red Hat AI Inference Server
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux AI (RHEL AI) 3
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux AI (RHEL AI) 3
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux AI (RHEL AI) 3
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux AI (RHEL AI) 3
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux AI (RHEL AI) 3
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux AI (RHEL AI) 3
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux AI (RHEL AI) 3
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift AI (RHOAI)
Versions Default: affected

Workarounds

To mitigate this issue, avoid processing untrusted MPEG-PS/VOB media files with FFmpeg. If FFmpeg is used in automated media processing services, implement strict input validation and isolation to prevent the ingestion of malicious files from untrusted sources. For end-user applications, refrain from opening or playing untrusted media files.

Credits

  • Red Hat would like to thank Quang Luong (Calif.io in collaboration with OpenAI Codex) for reporting this issue.

References

Problem Types

  • Integer Overflow or Wraparound CWE