CVE-2026-66041

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5	Patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625	Exploit Patch
https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) FFmpeg 7.0 hasta 8.1.2, corregido en el commit 4da9812, contiene una vulnerabilidad de escritura fuera de límites en el heap en el filtro vf_quirc que permite a un atacante corromper la memoria del heap al proporcionar un archivo de subtítulos PGS/SUP manipulado con dimensiones de fotograma no coincidentes. Los atacantes pueden proporcionar un archivo de subtítulos cuya segunda presentación tiene dimensiones mayores que la primera, haciendo que av_image_copy_plane() copie datos que exceden el tamaño de asignación inicial en el búfer de imagen en escala de grises de libquirc de tamaño insuficiente, lo que resulta en corrupción del heap y caída del proceso con potencial de ejecución de código.

Information

Published : 2026-07-24 20:18

Updated : 2026-10-24 13:10

NVD link : CVE-2026-66041

Mitre link : CVE-2026-66041

CVE.ORG link : CVE-2026-66041

JSON object : View

Products Affected

ffmpeg

ffmpeg

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-66041", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66041", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-28T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg", "vendor": "FFmpeg", "product": "FFmpeg", "versions": [{"status": "affected", "version": "7.0", "versionType": "custom", "lessThanOrEqual": "8.1.2"}, {"status": "unaffected", "version": "4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "versionType": "git"}], "defaultStatus": "affected"}]}], "published": "2026-07-24T20:18:21.240", "references": [{"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "tags": ["Exploit", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."}, {"lang": "es", "value": "FFmpeg 7.0 hasta 8.1.2, corregido en el commit 4da9812, contiene una vulnerabilidad de escritura fuera de l\u00edmites en el heap en el filtro vf_quirc que permite a un atacante corromper la memoria del heap al proporcionar un archivo de subt\u00edtulos PGS/SUP manipulado con dimensiones de fotograma no coincidentes. Los atacantes pueden proporcionar un archivo de subt\u00edtulos cuya segunda presentaci\u00f3n tiene dimensiones mayores que la primera, haciendo que av_image_copy_plane() copie datos que exceden el tama\u00f1o de asignaci\u00f3n inicial en el b\u00fafer de imagen en escala de grises de libquirc de tama\u00f1o insuficiente, lo que resulta en corrupci\u00f3n del heap y ca\u00edda del proceso con potencial de ejecuci\u00f3n de c\u00f3digo."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3237FF3C-806C-4EAB-AF57-D2522E4BD2DA", "versionEndIncluding": "8.1.2", "versionStartIncluding": "7.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}