A flaw in the S/PDIF muxer of FFmpeg permits an attacker to perform an out‑of‑bounds read when a crafted DTS stream with an oversized core_size is re‑muxed as SPDIF. The missing bounds check in the spdif_header_dts4 function allows memory beyond the packet buffer to be accessed, potentially leaking sensitive data.

FFmpeg distributions from version 0.7.1 up through 8.1.2 are affected. Any deployment that processes DTS audio streams via the S/PDIF re‑muxing functionality is vulnerable.

The CVSS score of 7.1 indicates a high severity, while the EPSS score is < 1% and the vulnerability is not listed in CISA KEV. Exploitation would require an attacker to supply a malicious DTS-HD audio stream during S/PDIF re‑muxing to trigger unauthorized memory reads beyond the packet buffer. The absence of a public exploit does not reduce the risk given the severity and the way the flaw can be triggered.