PT-2026-64417 · FFmpeg · Ffmpeg

Adrian Junge · CVE-2026-66041 · Published 2026-07-24 · Updated 2026-07-24

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av image copy plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-66041

Affected Products

Ffmpeg

References · 4

• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-66041 · Security Note
• https://vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter · Note
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625 · Note