PT-2026-64155 · FFmpeg · Ffmpeg

Adrian Junge · CVE-2026-65704 · Published 2026-07-23 · Updated 2026-07-23

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten decode frame(), where conversion to size t wraps the value to near SIZE MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.

Fix

Integer Underflow

Memory Corruption

Weakness Enumeration

CWE-191

CWE-787

Related Identifiers

CVE-2026-65704

Affected Products

Ffmpeg

References · 4

• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-65704 · Security Note
• https://vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder · Note
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767 · Note