CVE-2026-66037

Katalog CVE

CVSS 5.5 · Medium EPSS 0,35%

Kerentanan Allocation of Resources Without Limits or Throttling pada ffmpeg. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.

Rincian

Terbit di NVD

24 Juli 2026

Terakhir diubah

7 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5 patch
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627 issue tracking · patch
• https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentatio... advisory pihak ketiga