Multiple high-severity vulnerabilities have been identified in FFmpeg, the widely used open-source multimedia framework. These flaws impact media parsing, decoding, filtering, and encoding components and can be triggered when an application processes malicious files.
Several issues can lead to heap memory corruption, which may cause an affected application to crash and, in certain scenarios, could be exploited for arbitrary code execution. Other vulnerabilities can facilitate denial-of-service attacks through excessive memory allocation or expose uninitialized heap memory.
The vulnerabilities have been addressed in upstream FFmpeg commits, and organizations should upgrade to a version that includes the patches or rebuild FFmpeg using the referenced updates.
Multiple FFmpeg Vulnerabilities
CVE-2026-66036 has a CVSS score of 7.7 and affects the vf_hqdn3d video denoising filter. An attacker can supply a video where the frame resolution increases after the first frame.
When filtergraph reinitialization is disabled using the -reinit_filter 0 option, FFmpeg allocates line-history buffers based on the initial frame width. Larger frames later in the stream can cause denoise_spatial() to write outside these buffers, corrupting heap memory.
CVE-2026-66041, also rated 7.7, affects the vf_quirc filter in FFmpeg versions 7.0 through 8.1. A crafted PGS/SUP subtitle file may contain a later presentation with dimensions larger than the initial presentation, causing FFmpeg to copy excessive data into an undersized grayscale image buffer used by libquirc.
CVE-2026-66039 is an integer overflow and heap buffer overflow issue in the MACE6 audio decoder. A malicious CAF file can exploit oversized values for bytes_per_packet and frames_per_packet. This overflow may lead to an undersized allocation followed by an out-of-bounds write.
CVE-2026-66040 affects FFmpeg’s native PNG and APNG encoders. A crafted PNG image containing a malicious eXIf metadata chunk can cause output serialization to exceed the estimated allocation size, resulting in deterministic heap corruption that may enable code execution.
CVE-2026-66037 is an uncontrolled resource consumption flaw in the IAMF demuxer, with a CVSS score of 7.1. A specially crafted 171-byte file can trigger multi-gigabyte memory allocation through an attacker-controlled count_label field, potentially causing an out-of-memory condition during format probing.
CVE-2026-66038, also scored 7.1, affects the LCL/ZLIB video decoder. A valid but short zlib stream may leave parts of an output frame uninitialized.
FFmpeg may then copy uninitialized heap contents into observable output, potentially disclosing allocator data and weakening Address Space Layout Randomization (ASLR) protections in long-running services.
Organizations should update FFmpeg immediately to a version that includes the upstream fixes. Relevant fixes include commits 5d7112c, 8670835, e7cbfd1, aafb5c6, b506faf, and 4da9812.
If immediate patching is not feasible, administrators should restrict the processing of untrusted media, isolate transcoding workloads, enforce memory limits, and avoid using risky filter configurations, such as -reinit_filter 0, with untrusted video inputs.
