CVE-2026-107676 in FFmpeg
Summary
by MITRE • 10/08/2026
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in FFmpeg versions through 9.0.2 represents a critical information disclosure flaw located within the av_dynamic_hdr_plus_to_t35 function, which is responsible for converting Dynamic HDR Plus metadata to T.35 format. This specific memory safety issue arises when the tone_mapping_flag variable evaluates to zero, causing the code path to skip initialization of certain payload bytes. Consequently, up to three bytes in the output buffer remain uninitialized and retain whatever data was previously stored at that memory location within the application process. This behavior constitutes a classic case of an uninitialized memory disclosure vulnerability, where sensitive internal state or residual data from previous operations is inadvertently exposed through normal functional outputs rather than being cleared before use.
From a technical perspective, this flaw allows attackers to exploit the remuxing and transcoding capabilities of FFmpeg by supplying specially crafted Matroska T.35 BlockAdditional elements or HEVC and AV1 Supplemental Enhancement Information metadata structures. When such maliciously constructed inputs are processed, the application writes these uninitialized memory regions directly into the resulting output files. This mechanism effectively transforms a standard media processing task into an information leak vector, as the attacker can control the input structure to trigger the specific code path that fails to zero out the relevant memory segments before writing them to disk or stream.
The operational impact of this vulnerability is significant because it enables remote attackers to extract arbitrary bytes from the process memory space where FFmpeg is executing. Depending on what data resides in those uninitialized locations, an attacker could potentially leak sensitive information such as cryptographic keys, session tokens, private user data, or other internal application states that were previously allocated and freed but not overwritten. This type of vulnerability undermines the confidentiality guarantees expected from media processing software, particularly in environments where FFmpeg is used to process untrusted content provided by external users or services.
This flaw aligns with Common Weakness Enumeration identifier CWE-200, which covers Information Exposure through Uninitialized Memory Disclosure, and can be mapped to ATT&CK technique T1537, specifically the Transfer Data to Cloud Account sub-technique if the leaked data is exfiltrated via networked output streams. Mitigation strategies primarily involve upgrading FFmpeg to a version later than 9.0.2 where this initialization logic has been corrected. In scenarios where immediate patching is not feasible, organizations should implement strict input validation and sanitization of Matroska T.35 BlockAdditional fields and HEVC/AV1 SEI metadata before passing them to the library. Additionally, deploying memory protection mechanisms such as Address Sanitizer during development or using runtime application self-protection tools can help detect and mitigate similar uninitialized memory access patterns in production environments.