The vulnerability in FFmpeg up to version 8.1.2 involves an out-of-bounds write triggered by a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements the packet size without verifying bounds, resulting in a negative size that, when converted to size_t, wraps to a very large value. This leads to memcpy() reading beyond the source allocation and writing far beyond the Shorten decoder's bitstream buffer, causing heap corruption. This vulnerability is tracked as CVE-2026-65704 and is classified under CWE-191 (Integer Underflow).

Successful exploitation can cause heap corruption, which may lead to application crashes or potentially arbitrary code execution depending on the context. The vulnerability requires processing a specially crafted ffconcat file with the -safe 0 flag, which may limit exposure. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid processing untrusted ffconcat files with the -safe 0 flag to mitigate risk.