A signed integer overflow vulnerability exists in the DVB subtitle parser component of FFmpeg (libavcodec/dvbsub_parser.c) in versions from 0.5 up to but excluding 9.0. The vulnerability occurs when processing crafted WTV files, causing the bounds-check guard to wrap to INT_MIN and bypass the PARSE_BUF_SIZE comparison. This leads to memcpy() being invoked with attacker-controlled data, resulting in an out-of-bounds heap write. The flaw can cause memory corruption and potentially allow code execution. Ubuntu has issued security advisories and provides patches via Ubuntu Pro ESM for affected LTS releases.

Successful exploitation can lead to denial of service or arbitrary code execution due to heap buffer overflow and memory corruption. The vulnerability affects Ubuntu 16.04, 18.04, 20.04, 22.04, and 24.04 LTS releases with FFmpeg packages prior to the patched versions. No known exploits are reported in the wild at this time.

A fix is available and can be applied by updating FFmpeg packages to the patched versions provided by Ubuntu Pro via Extended Security Maintenance (ESM). Standard system updates on supported Ubuntu LTS releases will apply these fixes. Users should ensure they are running the updated package versions listed in the Ubuntu advisory USN-8680-1.