The vulnerability is a signed integer overflow that leads to heap buffer overflow when the DVB subtitle parser processes a crafted WTV file. The overflow bypasses bounds checks, causing an out‑of‑bounds write and potentially corrupting memory or enabling arbitrary code execution. The weakness is expressed by CWE-190 and CWE-787.

Affected products are FFmpeg versions from 0.5 up to but excluding 9.0. Any system running these FFmpeg binaries that accepts WTV subtitle files is at risk. The issue resides in libavcodec/dvbsub_parser.c and does not depend on external configuration, so any deployment using the vulnerable library is potentially compromised.

The CVSS score of 8.5 indicates a high severity. EPSS is not provided, and the vulnerability is not listed in KEV, implying no known widespread exploitation yet. The likely attack vector involves delivering a malicious WTV file to a vulnerable process, which could be achieved via remote media streams, URLs, or local media consumption. Attackers would need to trigger the parser, so influencing what the application processes. Given the absence of publicly confirmed exploits and the high severity, the risk remains significant.