important · Zero-click / RCE
A malformed VVC bitstream can write past FFmpeg's slice-entry-point array.
Affects
FFmpeg, a cross-platform multimedia decoding and processing library used by media applications and services.
An affected consumer must decode the bitstream; missing entry-point bounds enforcement then produces an out-of-bounds CTU-index write.
Detail and 3 sources
Code-execution control and an automatic remote delivery path remain unproved. The fix reached master and release/9.0, but it was not read for a Priority Finding.
Chain to watch
Deliver a crafted VVC bitstream to an affected consumer→↓Trigger the slice-entry-point overwrite→↓Establish overwrite control and an automatic remote ingestion path→↓Both exploitability and receipt-only reachability remain unproved.
Unverified chainReproduce the regression input, characterize the overwritten object and test automatic VVC consumers.