FFmpeg in versions before 9.0.2 suffers a heap buffer overflow triggered during the processing of ARIB STD‑B24 caption streams that use the text subtitle subtype. The routine aribcaption_trans_text_subtitle() incorrectly assumes that the sub‑region array has been allocated with a non‑zero size and writes past the end of a zero‑length allocation when a stream contains zero regions. This overflow corrupts adjacent heap objects and could lead to execution of arbitrary code or program crash.

The flaw exists in the FFmpeg project, affecting all distributions that ship libavcodec/libaribcaption.c compiled with a version of FFmpeg older than 9.0.3. Any system that decodes ARIB STD‑B24 captions in a caption stream—such as popular media players, streaming services, or embedded devices using FFmpeg—may be impacted when the affected sub‑type is encountered. Versions 9.0.3 and later contain the security fix.

With a CVSS score of 7.3 the vulnerability is deemed high severity. No EPSS score is publicly available, and the flaw is not listed in the CISA KEV catalog, meaning there is no known widespread exploitation. The attack vector is inferred to be remote, as a malicious media file can be supplied to an application that uses FFmpeg to decode subtitles. A successful exploitation would allow memory corruption that could be leveraged for code execution or denial of service, depending on the victim process privileges.