An integer overflow can occur when FFmpeg processes Common Encryption (CENC) subsample data, leading to an out‑of‑bounds write in libavformat/mov.c. This overflow arises from insufficient bounds checking during media parsing and can corrupt stack or heap memory, potentially causing an application crash.

All releases of FFmpeg before version 8.1 are affected. Any deployment that processes media files containing CENC subsample information on those versions is susceptible.

The CVSS score of 4.9 indicates moderate severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply a malicious media file with crafted CENC data to trigger the overflow. If an application uses FFmpeg to process untrusted media or accepts media from external sources, the risk of exploitation is higher. No widespread exploitation has been reported. Updating the library is the recommended mitigation.