Critical FFmpeg Vulnerabilities Let Attackers Corrupt Memory

Key Takeaways

• Multiple high-severity vulnerabilities have been discovered in FFmpeg, a widely used open-source multimedia framework.
• These flaws affect various components, including media parsing, decoding, filtering, and encoding.
• Attackers can exploit these vulnerabilities by crafting malicious media files, potentially leading to memory corruption, denial-of-service, or information disclosure.
• Heap memory corruption could enable arbitrary code execution in some scenarios.
• Patches have been released in upstream FFmpeg commits, and immediate updates are strongly recommended.

FFmpeg Under Scrutiny for Critical Memory Corruption Flaws

A series of high-severity vulnerabilities have been identified within FFmpeg, the ubiquitous open-source multimedia framework. These critical flaws, impacting key functionalities such as media parsing, decoding, filtering, and encoding, pose significant risks. Threat actors could exploit these vulnerabilities by leveraging specially crafted media files, potentially leading to severe system compromise.

The identified issues predominantly involve heap memory corruption, which can cause applications to crash unexpectedly. In more advanced attack scenarios, these vulnerabilities could be leveraged to achieve arbitrary code execution. Other discovered flaws facilitate denial-of-service (DoS) attacks through excessive memory allocation or expose sensitive, uninitialized heap memory, potentially aiding further exploitation.

Developers have already addressed these vulnerabilities through upstream FFmpeg commits. Organizations utilizing FFmpeg are strongly advised to upgrade to patched versions or recompile the framework using the specified updates to mitigate these risks effectively.

Detailed Vulnerability Breakdown

One notable vulnerability, CVE-2026-66036, carries a CVSS score of 7.7. This flaw resides within the vf_hqdn3d video denoising filter. An attacker can exploit this by providing a video where the frame resolution dynamically increases after the initial frame. When the -reinit_filter 0 option is enabled, disabling filtergraph reinitialization, FFmpeg allocates line-history buffers based on the first frame’s width. Subsequent larger frames can then cause the denoise_spatial() function to write beyond these allocated buffers, leading to heap memory corruption.

Another critical issue, CVE-2026-66041, also rated 7.7, impacts the vf_quirc filter in FFmpeg versions 7.0 through 8.1. This vulnerability can be triggered by a malformed PGS/SUP subtitle file. If a later presentation within the subtitle file has dimensions exceeding the initial presentation, FFmpeg may attempt to copy an excessive amount of data into an undersized grayscale image buffer utilized by libquirc, resulting in a heap-out-of-bounds write.

The MACE6 audio decoder is susceptible to CVE-2026-66039, an integer overflow that escalates to a heap buffer overflow. By crafting a malicious CAF (Core Audio Format) file with oversized values for bytes_per_packet and frames_per_packet, an attacker can induce an integer overflow. This overflow then leads to an undersized memory allocation, subsequently followed by a dangerous out-of-bounds write operation.

FFmpeg’s native PNG and APNG encoders are affected by CVE-2026-66040. A specially crafted PNG image containing a malicious eXIf metadata chunk can cause the output serialization process to exceed its estimated allocation size. This results in deterministic heap corruption, which could potentially be leveraged for arbitrary code execution.

An uncontrolled resource consumption flaw, CVE-2026-66037, has been identified in the IAMF demuxer, scoring 7.1 on the CVSS scale. A mere 171-byte malicious file can trigger multi-gigabyte memory allocations due to an attacker-controlled count_label field. This could lead to an out-of-memory condition during format probing, effectively causing a denial-of-service.

Finally, CVE-2026-66038, also rated 7.1, impacts the LCL/ZLIB video decoder. A short but valid zlib stream can leave portions of an output frame uninitialized. FFmpeg may then copy these uninitialized heap contents into observable output, potentially disclosing sensitive allocator data. In long-running services, this could weaken Address Space Layout Randomization (ASLR) protections, making further exploitation easier.

What You Should Do

• Update Immediately: Organizations should prioritize updating FFmpeg to a version that incorporates the upstream fixes. Specifically, look for commits 5d7112c, 8670835, e7cbfd1, aafb5c6, b506faf, and 4da9812.
• Restrict Untrusted Media: If immediate patching is not feasible, implement strict controls to prevent the processing of untrusted or unverified media files.
• Isolate Workloads: Isolate FFmpeg transcoding workloads within sandboxed environments or virtual machines to limit the potential impact of a successful exploit.
• Enforce Memory Limits: Configure memory limits for FFmpeg processes to mitigate the impact of uncontrolled resource consumption vulnerabilities like CVE-2026-66037.
• Avoid Risky Filter Configurations: Refrain from using potentially risky filter configurations, such as -reinit_filter 0, especially when processing input from untrusted sources.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.