FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3542-1 advisory.

    Update to release 4.4.8.

    - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code     execution       (bsc#1269490).
    - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service     (bsc#1268595).
    - CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution       (bsc#1272752).
    - CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory     corruption       (bsc#1272754).
    - CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure     and memory       corruption (bsc#1272758).
    - CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to     sensitive information       disclosure (bsc#1272768).
    - CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and     arbitrary code       execution (bsc#1272765).

    Other updates and bugfixes:

    - Release 4.4.8
      * Various bug fixes to codecs
      * avcodec/magicyuv: Fix 1 line MEDIAN slices
      * avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
      * avcodec/magicyuv: reject slice_height misaligned with chroma vshift

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3552-1 advisory.

    - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).
    - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3529-1 advisory.

    Update to release 4.4.8.

    - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code     execution       (bsc#1269490).
    - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service     (bsc#1268595).
    - CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution       (bsc#1272752).
    - CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory     corruption       (bsc#1272754).
    - CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure     and memory       corruption (bsc#1272758).
    - CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to     sensitive information       disclosure (bsc#1272768).
    - CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and     arbitrary code       execution (bsc#1272765).

    Other updates and bugfixes:

    - Release 4.4.8
      * Various bug fixes to codecs
      * avcodec/magicyuv: Fix 1 line MEDIAN slices
      * avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
      * avcodec/magicyuv: reject slice_height misaligned with chroma vshift

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21522-1 advisory.

    Changes in ffmpeg-4:

    - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758)
    - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754)
    - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752)
    - CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768)
    - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle     demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle     file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers     can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the     vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution     in any application using FFmpeg's VobSub demuxer. (CVE-2026-64830)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
334789	SUSE SLED15: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (SUSE-SU-2026:3542-1)	Nessus	SuSE Local Security Checks	Local	high
334704	SUSE SLED15: ffmpeg / libavcodec-devel / libavcodec57 / libavdevice57 / etc (SUSE-SU-2026:3552-1)	Nessus	SuSE Local Security Checks	Local	high
333552	SUSE SLES15: libavcodec58_134 / libavformat58_76 / libavutil56_70 / etc (SUSE-SU-2026:3529-1)	Nessus	SuSE Local Security Checks	Local	high
332106	openSUSE 16: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (openSUSE-SU-2026:21522-1)	Nessus	SuSE Local Security Checks	Local	high
329587	Linux Distros Unpatched Vulnerability : CVE-2026-64830	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-64830

high

Tenable Plugins

high

high

high

high

high