Calif.io credits OpenAI Codex on FFmpeg parser CVE

The public CVE record credits Quang Luong of Calif.io in collaboration with OpenAI Codex for an FFmpeg DVD subtitle parser memory-safety bug.

Bug class: Signed integer overflow and media-parser memory corruption
Affected codebase: FFmpeg
Credited system: OpenAI Aardvark / Codex Security
Disclosed: June 8, 2026
Attribution: Direct source attribution
Severity: medium

Source status: The CVE record for CVE-2026-6385 carries Red Hat's finder credit to Quang Luong, Calif.io, and OpenAI Codex. The Apache HTTP/2 finding previously grouped here now has its own Daybreak-linked page.

Summary

CVE-2026-6385 is an FFmpeg DVD subtitle parser signed-integer-overflow issue that can cause denial of service and potentially arbitrary code execution when processing malicious MPEG-PS/VOB media.

Attribution

The CVE record contains Red Hat’s public credit string naming OpenAI Codex.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.