CVE-2026-65705

Katalog CVE

CVSS 7.8 · High EPSS 0,19%

Kerentanan Incorrect Calculation of Buffer Size pada ffmpeg. Skor CVSS 3.1 7.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.

Rincian

Terbit di NVD

23 Juli 2026

Terakhir diubah

7 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-131: Incorrect Calculation of Buffer Size
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c patch
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780 issue tracking · patch
• https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame advisory pihak ketiga