FFmpeg before 8.1.3 and in the 9.x series before 9.0.2 contains a heap buffer overflow bug in the DVD subtitle encoder. The flaw stems from an underestimation of the run‑length encoded output size for odd‑width rectangles. Attackers can supply a media file with a crafted bitmap subtitle, and when ffmpeg transcodes the subtitle to the dvdsub encoder the resulting overflow writes past the allocated output buffer, corrupting heap memory. This vulnerability is characterized as CWE‑131 – incorrect calculation of buffer size. The consequence is potential arbitrary code execution or denial of service via heap corruption.

The products affected are FFmpeg, specifically any release prior to 8.1.3 or the 9.x series before 9.0.2. The vulnerability resides in the libavcodec/dvdsubenc.c component. System administrators using these FFmpeg versions should verify the installed release and plan for remediation.

The calculated CVSS score is 8.5, indicating a high severity issue. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalogue. Attackers need only provide a crafted media file to the ffmpeg engine, making the attack remotely achievable in environments where ffmpeg processes untrusted media, such as media conversion services or user‑supplied uploads. Given the lack of a known exploit and the absence from KEV, the exact likelihood of exploitation is uncertain, but the high severity and heap corruption mechanism warrant prompt attention.