FFmpeg versions 7.0 before 8.1.3 and 9.x before 9.0.2 have been found to contain several heap buffer overflow vulnerabilities. These vulnerabilities are located in vk_av1_decode_slice(), liboapve_encode(), and vaapi_hevc_start_frame() functions within the libavcodec component.
The vulnerabilities allow attackers to exploit the system by supplying crafted media streams. Specifically, an AV1 stream with more than 256 tiles can overflow tile_sizes, while frames larger than configured dimensions can corrupt heap memory. Additionally, a crafted HEVC bitstream with a large picture and many tiles can write controlled 16-bit values past heap-allocated data.
These vulnerabilities are assessed as high risk, particularly when untrusted media is processed using Vulkan acceleration or during encoding processes. Media servers, transcoders, and desktop applications that handle untrusted video are most susceptible to these security issues.
Exploitation of these vulnerabilities requires user interaction and crafted input, classifying it as a local attack. However, there is no evidence confirming active exploitation of these vulnerabilities in the wild at this time.