A heap buffer overflow occurs in FFmpeg's hvcC box writer when it processes an HEVC configuration record containing more NAL units of a single type than the count field can represent. The overflow corrupts memory on the heap while muxing a crafted HEVC file, potentially enabling an attacker to execute arbitrary code. This flaw arises from improper handling of the NAL unit count and could be leveraged to compromise the host process if malicious HEVC data is processed.

All FFmpeg builds that contain code before commit acf5d7c are affected. This includes every release that has not yet incorporated the fix introduced by that commit. Users running older FFmpeg versions to perform HEVC muxing are therefore vulnerable.

The vulnerability carries a CVSS score of 8.5, indicating high severity. The EPSS score is not available, so the current exploitation probability remains uncertain but potentially high for systems processing untrusted media. The flaw is not yet catalogued in CISA's KEV list, meaning no confirmed public exploits yet, but that does not reduce the threat. Attackers can trigger the overflow by crafting a malicious HEVC file and running the FFmpeg binary with it. The likely attack vector is inferred to be local when FFmpeg executes on the host, or remote when the application exposing FFmpeg is reachable from untrusted networks.