FFmpeg versions up to 8.1.2 allow an out-of-bounds write that can corrupt heap memory. The vulnerability is triggered when the TY demuxer’s demux_audio() function decreases a packet size without bounds checking, producing a negative value. That negative value is later passed to memcpy() in shorten_decode_frame(); the conversion to size_t wraps the value to a value near SIZE_MAX, leading to reads beyond the source allocation and writes far beyond the Shorten decoder’s bitstream buffer. The result is heap corruption, which may enable further exploitation depending on the surrounding memory state.

The vulnerability applies to all FFmpeg releases at or below version 8.1.2, across any operating system that includes the affected library. Any application or service that incorporates FFmpeg 8.1.2 or earlier for media processing is potentially impacted. The vendor, FFmpeg, lists the affected product as FFmpeg; the CPE string confirms the reach across all FFmpeg installations.

The CVSS score of 7.3 indicates high severity, yet the EPSS score is below one percent and the vulnerability is not in the CISA KEV catalog, suggesting a low probability of exploitation at present. The attack requires an attacker to supply a crafted ffconcat file processed with the –safe 0 flag to a running FFmpeg instance; no explicit privilege escalation or remote code execution is described in the CVE text. Based on the description, it is inferred that an attacker would need to get the application to process a malicious ffconcat file, which may be feasible if the service accepts user‑supplied media sources.