PT-2026-64412 · FFmpeg · Ffmpeg

Adrian Junge · CVE-2026-66036 · Publicado 2026-07-24 · Atualizado 2026-07-24

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit filter 0 option. Attackers can provide a malicious video input where vf hqdn3d.config input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise spatial() to write beyond the allocation boundary, resulting in heap memory corruption.

Correção

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-122

Identificadores relacionados

CVE-2026-66036

Produtos afetados

Ffmpeg

Referências · 4

• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c · Correção
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783 · Nota
• https://vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-66036 · Nota de Segurança