CVE-2026-64833 | FFmpeg up to 8.1.2 SPDIF Muxer spdif_header_dts4 core_size out-of-bounds (Nessus ID 344622 / WID-SEC-2026-2491)

A vulnerability labeled as critical has been found in FFmpeg up to 8.1.2. Affected is the function spdif_header_dts4 of the component SPDIF Muxer. The manipulation of the argument core_size results in out-of-bounds read. This vulnerability is reported as CVE-2026-64833. The attack can be launched remotely. No exploit exists.