FFmpeg versions up to and including 9.0.2 implement a function that parses ARIB caption data. An error cleanup routine in aribcaption_trans_ass_subtitle() mistakenly releases memory for subtitle rectangles using a region counter that can exceed the bounds of the allocated array. This out‑of‑bounds free corrupts the heap, potentially allowing an attacker to corrupt control data and execute arbitrary code. The flaw arises when a crafted ARIB caption contains a region index that surpasses the 8 KiB AVBPrint limit, exposing the vulnerability whenever the cleanup runs.

All installations of the FFmpeg multimedia framework with version 9.0.2 or earlier are affected. The vulnerability is limited to FFmpeg binaries that enable the libaribcaption module for subtitle processing.

The CVSS score of 7.3 indicates a high severity, and while an EPSS score is not reported, the presence of a heap corruption that can lead to code execution suggests a non‑negligible risk. The vulnerability is not listed in CISA’s KEV catalog. An attacker can trigger the flaw by supplying a malicious ARIB caption file to any software that uses the affected FFmpeg build, making the attack vector local or remote depending on how the file is processed. Successful exploitation could lead to full system compromise of the host running the FFmpeg process.