Libav: FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt… (CVE-2026-64830)

This Red Hat security advisory addresses several vulnerabilities in the ffmpeg package used in Red Hat Enterprise Linux AI 3.4. The fixed issues include CVE-2026-64830 (heap buffer overflow via VobSub subtitle demuxer), CVE-2026-64832 (double-free in NVDEC hardware decoder), CVE-2026-64835 (out-of-bounds memory access in ADX audio decoder), CVE-2026-66038 (information disclosure in LCL/ZLIB video decoder), CVE-2026-66039 (heap out-of-bounds write in MACE6 audio decoder), and CVE-2026-66041 (heap out-of-bounds write via vf_quirc filter). These vulnerabilities could lead to memory corruption or information leaks if exploited. The advisory pertains to ffmpeg versions prior to 8.1.3 in the RHEL AI 3.4 environment.

The vulnerabilities fixed in this update could allow an attacker to cause memory corruption (heap buffer overflow, double-free, out-of-bounds writes) or information disclosure through specially crafted media files processed by ffmpeg. This could potentially lead to denial of service or exposure of sensitive information within the affected environment. The severity is rated as high by Red Hat.

Red Hat has released an official security update for ffmpeg in Red Hat Enterprise Linux AI 3.4 that addresses these vulnerabilities. Users should apply this update promptly after ensuring all previous errata relevant to their system are applied. The advisory provides detailed package versions and instructions for applying the update. No additional mitigations are specified beyond applying the official patch.