FFmpeg versions 2.1 through 8.1.2 contain a heap buffer overflow in the VobSub subtitle demuxer. An attacker can supply a malicious .sub/.idx subtitle file that declares more distinct stream IDs than the fixed‑size array allocated in libavformat/mpeg.c. This causes ff_subtitles_queue_insert() to write beyond the vobsub->q[] array boundary, corrupting adjacent heap memory and potentially leading to arbitrary code execution in any process that uses the affected FFmpeg build.

The affected product is FFmpeg, all releases from 2.1 up to and including 8.1.2. Any software that embeds these FFmpeg versions and processes subtitle files is potentially impacted, including media players, transcoding pipelines, and streaming services that rely on FFmpeg's VobSub demuxer.

The CVSS score of 8.7 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation, and the flaw is not listed in CISA’s KEV catalog, suggesting no known exploitation events to date. The attack requires an attacker to supply a crafted subtitle file to the application – either locally or remotely if the application accepts user‑supplied media – which makes file‑based inputs the primary vector and is especially relevant for services that process untrusted video or subtitle input.