CVE-2026-66036

CVE-2026-66036 affects FFmpeg up to version 8.1.2. A heap out-of-bounds write exists in the vf_hqdn3d filter when a crafted video increases frame width between frames and filtergraph reinitialization is disabled (-reinit_filter 0). The vulnerability stems from vf_hqdn3d.config_input() allocating ...

CVE-2026-66036 FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the...

CVE-2026-65706

A flaw was found in FFmpeg. This vulnerability, an out-of-bounds write in the vfswaprect video filter, allows an attacker to corrupt heap memory. By providing a specially crafted NV12 video frame with specific dimensions, a local user can trigger a memory corruption, leading to a process crash...

CVE-2026-64831

A flaw was found in FFmpeg. A remote attacker can exploit a stack buffer overflow vulnerability in the Vulkan HEVC High Efficiency Video Coding hardware decoder by providing a specially crafted HEVC/H.265 bitstream. This can lead to overwriting memory on the stack, potentially allowing the attack...

CVE-2026-65705

A flaw was found in FFmpeg. This vulnerability, an out-of-bounds write, affects the vffloodfill video filter. An attacker could exploit this by providing a malicious video stream, which, when processed with filtergraph reinitialization disabled, causes heap memory corruption. This can lead to a...

CVE-2026-65704

A flaw was found in FFmpeg. A remote attacker can exploit this vulnerability by providing a specially crafted ffconcat file, which, when processed with the -safe 0 flag, triggers an out-of-bounds write. This occurs due to improper bounds checking in the TY demuxer's demuxaudio function, leading t...

OPENSUSE-SU-2026:11361-1 ffmpeg-7-7.1.4-5.1 on GA media

These are all security issues fixed in the ffmpeg-7-7.1.4-5.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11360-1 ffmpeg-4-4.4.8-2.1 on GA media

These are all security issues fixed in the ffmpeg-4-4.4.8-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-64417

Name of the Vulnerable Software and Affected Versions FFmpeg versions 7.0 through 8.1.2 Description A heap out-of-bounds write exists in the vf quirc filter. An attacker can corrupt heap memory by providing a crafted PGS/SUP subtitle file with mismatched frame dimensions, specifically where the...

CVE-2026-65706

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

CVE-2026-65704

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

UBUNTU-CVE-2026-65706

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

UBUNTU-CVE-2026-65705

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vffloodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinitfilter 0. When configinput allocates the...

UBUNTU-CVE-2026-65704

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

UBUNTU-CVE-2026-65703

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdscparsetdsf function fails to unreference the...

CVE-2026-65706

CVE-2026-65706 affects FFmpeg versions 3.0–8.1.2. The vulnerability lies in the vf_swaprect video filter, where the filter_frame() reuses a temporary row buffer sized for plane 0’s single-byte pixel step across all planes. This leads to an out-of-bounds write: an 18-byte memcpy is performed into ...

CVE-2026-65706 FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

EUVD-2026-48373

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

CVE-2026-65706 FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

CVE-2026-65706

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...