FFmpeg, the ubiquitous open-source multimedia framework powering everything from video streaming platforms to cloud transcoding pipelines, has patched six high-severity vulnerabilities affecting all versions up to 8.1.2.
Disclosed on July 24, 2026, the flaws span heap buffer overflows, integer overflows, uncontrolled resource consumption, and information disclosure, with CVSS scores ranging from 7.1 to 8.7.
FFmpeg Patches Six High-Severity Flaws
CVE-2026-66036 (CVSS 7.7) hits the vf_hqdn3d denoising filter. When filtergraph reinitialization is disabled via -reinit_filter 0, a crafted video that increases resolution between frames causes denoise_spatial() to write past undersized per-plane buffers, corrupting heap memory.
CVE-2026-66037 (CVSS 7.1) is a denial-of-service flaw in the IAMF demuxer. The mix_presentation_obu() function in iamf_parse.c calls av_calloc() using an attacker-controlled count_label value before validating available data.
The flaw lets a mere 17-byte file trigger roughly 126 million bytes of allocation per input byte, exhausting memory or forcing an OOM-kill.
CVE-2026-66038 (CVSS 7.1) affects the LCL/ZLIB video decoder. A valid zlib stream that decompresses to fewer bytes than expected causes zlib_decomp() to treat the shortfall as non-fatal.
The flaw is leaking uninitialized heap memory, including pointer-derived allocator bytes, into the output frame, potentially defeating ASLR in long-running media services.
CVE-2026-66039 (CVSS 8.7), the most severe of the batch, involves a signed integer overflow in the MACE6 audio decoder.
Malicious bytes_per_packet and frames_per_packet values in a CAF file’s desc chunk overflow the sample count computation in mace_decode_frame(), producing an undersized buffer and heap out-of-bounds write with code execution potential.
CVE-2026-66040 (CVSS 8.7) targets the PNG/APNG encoder. A crafted eXIf chunk with duplicate IFD entries referencing the same large payload causes canonical serialization to balloon past the buffer size estimated by add_exif_profile_size().
The flaw lets png_write_chunk() overwrite tens of thousands of bytes, resulting in deterministic corruption and possible arbitrary code execution.
CVE-2026-66041 (CVSS 7.7) affects the vf_quirc filter (versions 7.0–8.1.2). A PGS/SUP subtitle file with mismatched frame dimensions across presentations causes av_image_copy_plane() to overrun the undersized libquirc grayscale buffer.
All six flaws share a common exploitation vector: processing an untrusted, specially crafted media file video, audio, subtitle, or image without requiring authentication.
Given FFmpeg’s role as the backbone for transcoding services, CDNs, social media platforms, and countless downstream applications (including browsers and mobile OSes that bundle it), these bugs carry significant supply-chain risk.
The two 8.7-rated flaws (MACE6 and PNG eXIf) are particularly concerning since they combine memory corruption with a credible path to code execution.
Mitigation
All issues are fixed in FFmpeg’s git master via the patch commits referenced in each advisory. Organizations running FFmpeg in automated pipelines, especially those accepting user-uploaded media, should prioritize:
- Upgrading to a patched build incorporating all six commits
- Sandboxing FFmpeg processes handling untrusted input
- Restricting or auditing use of
-reinit_filter 0and IAMF/CAF/PGS format parsing where not required
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
