The vulnerability is a heap out-of-bounds write (CWE-787) in the vf_quirc filter of FFmpeg. An attacker can supply a malformed PGS/SUP subtitle file where the second frame’s dimensions exceed the first frame’s, causing av_image_copy_plane() to write beyond the allocated buffer for a libquirc grayscale image. This corruption can trigger a process crash and, if the heap overwrite lands on executable or control data, could lead to arbitrary code execution.

The flaw affects FFmpeg version 7.0 up through 8.1.2, including any builds that enable the vf_quirc filter. All users running these releases on any platform are potentially vulnerable.

The CVSS score of 7.7 classifies the defect as high severity, but the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in KEV, indicating no known active exploitation. Attackers would need to supply a specially crafted subtitle file, implying the primary vector is local or any service that processes untrusted subtitle input. If exploitation succeeds, it can corrupt memory to enable remote code execution if memory corruption can be hijacked.