FFmpeg versions up through 8.1.2 contain a signed integer overflow in the MACE6 audio decoder. When the decoder parses a CAF file that contains an oversized bytes_per_packet and frames_per_packet value in the desc chunk, it incorrectly calculates the number of output samples, allocating a buffer that is too small. Writing output samples past the end of this undersized buffer causes a heap out‑of‑bounds write that can corrupt memory and potentially be abused to execute arbitrary code.

The vulnerability applies to FFmpeg releases through 8.1.2 that include the MACE6 audio decoder and process CAF files. Any installation that has this decoder enabled and receives CAF media is exposed, regardless of the specific application or operating system. The affected product is identified as FFmpeg:FFmpeg.

The CVSS score of 8.7 reflects a high severity, and the EPSS score of less than 1% indicates the current likelihood of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog. It requires an attacker to supply a crafted CAF file that triggers the integer overflow in mace_decode_frame() during output sample count computation, which then leads to a heap write beyond bounds. While the exact exploit chain is not detailed in the public description, the nature of the flaw implies that successful exploitation could allow an attacker to gain code execution privileges within the context of the FFmpeg process.