PT-2026-64156 · FFmpeg · Ffmpeg

Adrian Junge · CVE-2026-65705 · Publicado 2026-07-23 · Atualizado 2026-07-23

NVD

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit filter 0. When config input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

CWE-131

Identificadores relacionados

CVE-2026-65705

Produtos afetados

Ffmpeg

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-65705 · Nota de Segurança
• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c · Correção
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780 · Nota
• https://vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame · Nota