The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg possibly 2.1 and earlier allows remote attackers to have unspecified impact and vectors which trigger an out-of-bounds write.