ANT-2026-TJ0ZJHM6 · ffmpeg/ffmpeg

heap-buffer-overflow medium

Severity Claude critical · Security research firm medium · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-TJ0ZJHM6: Heap-buffer-overflow in assenc.c:189

A 336-byte crafted Matroska file, when processed by FFmpeg with subtitle stream copy to the ASS output format, triggers a heap underflow in the ASS muxer's write_packet function at libavformat/assenc.c:189. The out-of-bounds read accesses memory one byte before a 94-byte heap buffer that was allocated via realloc in matroska_decode_buffer (libavformat/matroskadec.c:1742). The crash is fully deterministic, reproducing identically in 3/3 runs under ASAN with SIGABRT (exit 134). An attacker who can supply a Matroska file to an FFmpeg pipeline that remuxes subtitles to ASS can trigger a 1-byte out-of-bounds heap read.

Target

Project: ffmpeg
Location: assenc.c:189

Technical Details

ASAN: READ of size 1 at an address 1 byte to the left of a 94-byte heap region. The ASS encoder's write_packet reads from index -1 of a packet buffer produced by the Matroska demuxer's matroska_decode_buffer, indicating a missing lower-bound check or an off-by-one when scanning backward in the subtitle payload.

Crash trace:

The PoC (336-byte Matroska file) deterministically triggers a heap-buffer-overflow (heap underflow) in FFmpeg's ASS subtitle encoder. All 3 reproduction runs in a fresh container produced identical ASAN reports:

- **Error type**: heap-buffer-overflow (READ of size 1)
- **Location**: `libavformat/assenc.c:189` in `write_packet`
- **Detail**: Access at address 1 byte to the left of a 94-byte heap allocation (heap underflow)
- **Allocation origin**: `libavformat/matroskadec.c:1742` in `matroska_decode_buffer` (via `realloc`)
- **Call chain**: `matroska_read_packet` -> demux -> mux -> `write_packet` (assenc.c:189)
- **Exit code**: 134 (SIGABRT from ASAN) in all 3 runs
- **Determinism**: 3/3 runs crashed with identical error signatures

The bug is a genuine heap underflow in FFmpeg's ASS subtitle muxer when processing a crafted Matroska input with subtitle stream copy to ASS output format.

Reproduction

  1. Craft a 336-byte Matroska file containing a malformed subtitle stream
  2. Invoke FFmpeg on the file with subtitle stream copy (-c:s copy or equivalent) targeting an .ass output
  3. Demuxer allocates the subtitle buffer in matroska_decode_buffer (matroskadec.c:1742)
  4. ASS muxer write_packet (assenc.c:189) reads 1 byte before the buffer start, triggering the heap underflow

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-TJ0ZJHM6.

Reference: ANT-2026-TJ0ZJHM6
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict
true positive
Severity
medium
TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-24 Reported to tracker
  2. 2026-05-10 Sent to maintainer
  3. 2026-05-16 Maintainer acknowledged
  4. 2026-05-19 Patch released
  5. 2026-07-20 Publicly revealed
PROVENANCE

SHA-3-512 hash:

7df1fc2c57f4f4a5b43206602da2173169994a829ec541ebf18ed6ef2be0d20072b0c3e797296fca1fe1bc0c160e89341698c3f201e440207adc2ecf0ef885fc

Committed 2026-05-13 10:55 PT

Revealed 2026-07-20 21:55 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-TJ0ZJHM6",
  "bug_class": "Heap-buffer-overflow",
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-03-24T18:30:59+00:00",
  "description": "A 336-byte crafted Matroska file, when processed by FFmpeg with subtitle stream copy to the ASS output format, triggers a heap underflow in the ASS muxer's write_packet function at libavformat/assenc.c:189. The out-of-bounds read accesses memory one byte before a 94-byte heap buffer that was allocated via realloc in matroska_decode_buffer (libavformat/matroskadec.c:1742). The crash is fully deterministic, reproducing identically in 3/3 runs under ASAN with SIGABRT (exit 134). An attacker who can supply a Matroska file to an FFmpeg pipeline that remuxes subtitles to ASS can trigger a 1-byte out-of-bounds heap read.",
  "discovered_at": null,
  "location": "assenc.c:189",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "ffmpeg",
  "reproduction": [
    "1. Craft a 336-byte Matroska file containing a malformed subtitle stream",
    "2. Invoke FFmpeg on the file with subtitle stream copy (-c:s copy or equivalent) targeting an .ass output",
    "3. Demuxer allocates the subtitle buffer in matroska_decode_buffer (matroskadec.c:1742)",
    "4. ASS muxer write_packet (assenc.c:189) reads 1 byte before the buffer start, triggering the heap underflow"
  ],
  "technical_details": "ASAN: READ of size 1 at an address 1 byte to the left of a 94-byte heap region. The ASS encoder's write_packet reads from index -1 of a packet buffer produced by the Matroska demuxer's matroska_decode_buffer, indicating a missing lower-bound check or an off-by-one when scanning backward in the subtitle payload.",
  "title": "Heap-buffer-overflow in assenc.c:189",
  "vendor_severity": "medium"
}