ECHO-191B-44FE-7772 Heap out-of-bounds write in the native PNG/APNG encoder when writing a crafted eXIf chunk (add_exif_profile_size() underestimates the sanitized IFD size). The eXIf-writing code does not exist in this source: libavcodec/pngenc.c at n7.1.5 (and on the release/7.1 branch) has no EXIF/IFD handling at all; it was added in the 8.x series, which is why the CVE range reads "through 8.1.2". Upstream fix b506fafe cannot apply here because the code it patches is absent. Refs: - https://security-tracker.debian.org/tracker/CVE-2026-66040 - https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc details: | If this spec is ever bumped to a version whose pngenc.c writes eXIf chunks (8.1+), this entry MUST be re-evaluated and converted into a real PATCH_TYPE_UPSTREAM_PATCH entry.