FFmpeg: Four Memory Corruption Vulnerabilities Disclosed in Batch

Key findings

• Four FFmpeg vulnerabilities disclosed together, including heap out-of-bounds writes and reads.
• Flaws affect PNG/APNG encoders, vf_quirc filter, TY demuxer, and S/PDIF muxer.
• Vulnerabilities can lead to heap memory corruption via crafted image, subtitle, ffconcat, or DTS stream files.
• Patches are available through specific commits and FFmpeg versions up to 8.1.2.

On July 25, 2026, a batch of four vulnerabilities affecting FFmpeg was disclosed, with the earliest reported on July 23rd. These vulnerabilities, primarily heap-based memory corruption flaws, highlight potential risks in how FFmpeg handles various media formats and streams. The disclosures primarily stem from Debian's security team, with advisories detailing specific components and fixes.

The vulnerabilities fall into a few categories based on the affected component and attack vector:

• Heap Out-of-Bounds Writes:
• CVE-2026-66040 involves a heap out-of-bounds write in the native PNG and APNG encoders. This flaw can be triggered by a specially crafted PNG image containing a malicious eXIf chunk, leading to heap memory corruption. This affects FFmpeg versions up to 8.1.2 and was fixed in commit b506faf.
• CVE-2026-66041 points to a heap out-of-bounds write vulnerability within the vf\_quirc filter. Attackers can exploit this by providing a crafted PGS/SUP subtitle file with mismatched frame dimensions, causing heap memory corruption. This impacts FFmpeg versions from 7.0 through 8.1.2 and was patched in commit 4da9812.
• CVE-2026-65704 describes an out-of-bounds write vulnerability in the TY demuxer's demux\_audio() function. By supplying a crafted ffconcat file and using the -safe 0 flag, attackers can trigger heap corruption. The vulnerability arises from decrementing packet size without proper bounds checking, resulting in a negative size value being used. This affects FFmpeg through 8.1.2.

• Heap Out-of-Bounds Read:
• CVE-2026-64833 details an out-of-bounds read vulnerability in the S/PDIF muxer. Attackers can exploit this by supplying a crafted DTS stream where the core_size value exceeds the actual packet length. This missing bounds check allows attackers to read memory beyond buffer boundaries. This affects FFmpeg versions from 0.7.1 through 8.1.2.

The disclosed vulnerabilities indicate potential weaknesses in FFmpeg's parsing and processing of specific file types and stream formats. While no reports of active exploitation in the wild were mentioned in the provided details, the nature of these vulnerabilities (heap corruption and out-of-bounds reads/writes) could potentially lead to denial-of-service conditions or, in more severe cases, arbitrary code execution if combined with other weaknesses or specific exploitation techniques.

The fixes for these vulnerabilities are detailed through specific commits: CVE-2026-66040 was addressed by commit b506faf, CVE-2026-66041 by commit 4da9812, and CVE-2026-65704 and CVE-2026-64833 are noted as being fixed in FFmpeg versions up to 8.1.2. Users are advised to update to patched versions to mitigate these risks.

This batch of vulnerabilities underscores the importance of regular security audits for widely used media processing tools like FFmpeg. Users should ensure they are running the latest stable versions to benefit from these security patches and protect against potential memory corruption exploits. The disclosures highlight specific areas within FFmpeg's demuxers and filters that require careful handling of input data.