Recent analyses have uncovered multiple high-severity vulnerabilities within FFmpeg, the widely utilized open-source multimedia framework. These flaws, affecting various components such as media parsing, decoding, filtering, and encoding, can be exploited when applications process specially crafted malicious files.
One notable vulnerability, identified as CVE-2026-66036, resides in the vf_hqdn3d video denoising filter. An attacker can craft a video where the frame resolution increases after the initial frame. If the filtergraph reinitialization is disabled using the -reinit_filter 0 option, FFmpeg allocates line-history buffers based on the initial frame width. Subsequent larger frames can cause the denoise_spatial() function to write outside these buffers, leading to heap memory corruption.
Another critical issue, CVE-2026-66041, affects the vf_quirc filter in FFmpeg versions 7.0 through 8.1. A malicious PGS/SUP subtitle file may contain a later presentation with dimensions exceeding the initial one. This discrepancy causes FFmpeg to copy excessive data into an undersized grayscale image buffer used by libquirc, resulting in a heap out-of-bounds write and potential process crashes.
CVE-2026-66039 involves an integer overflow and heap buffer overflow in the MACE6 audio decoder. A specially crafted CAF file can exploit oversized values for bytes_per_packet and frames_per_packet, leading to an undersized allocation followed by an out-of-bounds write, which may result in arbitrary code execution.
Additionally, CVE-2026-66040 targets FFmpeg’s native PNG and APNG encoders. A crafted PNG image containing a malicious eXIf metadata chunk can cause output serialization to exceed the estimated allocation size. This overflow results in deterministic heap corruption, potentially enabling code execution.
Another vulnerability, CVE-2026-66037, is an uncontrolled resource consumption flaw in the IAMF demuxer. A specially crafted 171-byte file can trigger multi-gigabyte memory allocation through an attacker-controlled count_label field, potentially causing an out-of-memory condition during format probing.
Furthermore, CVE-2026-66038 affects the LCL/ZLIB video decoder. A valid but short zlib stream may leave parts of an output frame uninitialized. FFmpeg may then copy uninitialized heap contents into observable output, potentially disclosing allocator data and weakening Address Space Layout Randomization (ASLR) protections in long-running services.
To mitigate these risks, organizations are strongly advised to update FFmpeg to versions that include the upstream fixes. Relevant patches include commits 5d7112c, 8670835, e7cbfd1, aafb5c6, b506faf, and 4da9812. If immediate patching is not feasible, administrators should restrict the processing of untrusted media, isolate transcoding workloads, enforce memory limits, and avoid using risky filter configurations, such as -reinit_filter 0, with untrusted video inputs.
These vulnerabilities underscore the critical importance of maintaining up-to-date software and implementing robust security measures when handling multimedia content. As FFmpeg is integral to numerous applications and services, timely remediation is essential to prevent potential exploitation and ensure system integrity.
