CVE-2026-65706

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527	Patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779	Issue Tracking Patch
https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

History

24 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) FFmpeg versiones 3.0 hasta 8.1.2 contienen una vulnerabilidad de escritura fuera de límites en el filtro de video vf_swaprect que permite a los atacantes corromper la memoria del heap al proporcionar un fotograma de video NV12 manipulado con dimensiones de ancho impares. La función filter_frame() reutiliza un búfer de fila temporal dimensionado para el paso de píxeles de un solo byte del plano 0 a través de todos los planos, causando un memcpy de 18 bytes en una asignación de heap de 17 bytes al procesar el plano de croma entrelazado de dos bytes por muestra de un fotograma NV12 de 17x16, lo que resulta en corrupción del heap y caída del proceso con potencial para la ejecución de código.

Information

Published : 2026-07-23 20:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-65706

Mitre link : CVE-2026-65706

CVE.ORG link : CVE-2026-65706

JSON object : View

Products Affected

ffmpeg

ffmpeg

CWE

CWE-131

Incorrect Calculation of Buffer Size

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-65706", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65706", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-23T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg", "vendor": "FFmpeg", "product": "FFmpeg", "versions": [{"status": "affected", "version": "3.0", "versionType": "custom", "lessThanOrEqual": "8.1.2"}, {"status": "unaffected", "version": "a7e38b617b32f996beaa371bbf04b39907d7a527", "versionType": "git"}], "defaultStatus": "affected"}]}], "published": "2026-07-23T20:17:22.257", "references": [{"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-131"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution."}, {"lang": "es", "value": "FFmpeg versiones 3.0 hasta 8.1.2 contienen una vulnerabilidad de escritura fuera de l\u00edmites en el filtro de video vf_swaprect que permite a los atacantes corromper la memoria del heap al proporcionar un fotograma de video NV12 manipulado con dimensiones de ancho impares. La funci\u00f3n filter_frame() reutiliza un b\u00fafer de fila temporal dimensionado para el paso de p\u00edxeles de un solo byte del plano 0 a trav\u00e9s de todos los planos, causando un memcpy de 18 bytes en una asignaci\u00f3n de heap de 17 bytes al procesar el plano de croma entrelazado de dos bytes por muestra de un fotograma NV12 de 17x16, lo que resulta en corrupci\u00f3n del heap y ca\u00edda del proceso con potencial para la ejecuci\u00f3n de c\u00f3digo."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41AC229F-883E-4FFA-9249-6C3D0A51B7D0", "versionEndIncluding": "8.1.2", "versionStartIncluding": "3.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}