JLSEC-2026-1187 FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vfquirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose seco...

CVE-2026-66041

FFmpeg 7.0–8.1.2 contains a heap out-of-bounds write in the vf_quirc filter, fixed by commit 4da9812. A crafted PGS/SUP subtitle file with mismatched frame dimensions can cause av_image_copy_plane() to copy data beyond the initial allocation into the undersized libquirc grayscale image buffer, le...