CVE-2026-66041

Katalog CVE

CVSS 7.8 · High EPSS 0,49%

Kerentanan Out-of-bounds Write pada ffmpeg. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Rincian

Terbit di NVD

24 Juli 2026

Terakhir diubah

7 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5 patch
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625 exploit · patch
• https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter advisory pihak ketiga