PT-2026-64417 · FFmpeg · Ffmpeg

Adrian Junge · CVE-2026-66041 · Publicado 2026-07-24 · Atualizado 2026-07-24

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av image copy plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2026-66041

Produtos afetados

Ffmpeg

Referências · 4

• https://vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter · Nota
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625 · Nota
• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-66041 · Nota de Segurança