CVE-2026-64835 in FFmpeg
Summary
by MITRE • 07/22/2026
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides in the FFmpeg multimedia framework's ADX audio decoder implementation where an out-of-bounds memory access flaw exists in versions ranging from 4.4 through 8.1.2. The issue specifically affects the libavcodec/adxdec.c component and manifests when processing ADX or AAX audio files that contain mid-stream channel layout changes. The vulnerability stems from how the decoder handles AV_PKT_DATA_NEW_EXTRADATA side data packets that arrive during active decoding sessions rather than at stream initialization. When such side data is received, the adx_decode_frame function performs a re-parsing of the stream header but neglects to synchronize the internal channel state variables with the updated channel configuration. This creates a critical inconsistency where the decoder continues to reference an outdated prev[] state array using a stale channel count value that no longer matches the current stream configuration. The technical flaw directly maps to CWE-129, which addresses out-of-bounds read/write conditions, and represents a classic buffer over-read scenario where memory locations beyond the allocated array boundaries are accessed during audio frame decoding operations.
The operational impact of this vulnerability extends across numerous applications that rely on FFmpeg for audio processing, including media players, content management systems, streaming platforms, and digital asset processing tools. Attackers can exploit this weakness by crafting malicious ADX or AAX files containing carefully constructed mid-stream channel layout changes that trigger the vulnerable code path. The out-of-bounds memory accesses can result in arbitrary code execution, system crashes, or information disclosure depending on the specific memory layout and execution environment. This vulnerability particularly affects systems processing user-uploaded audio content where input validation is insufficient, as it allows remote attackers to cause denial of service or potentially achieve privilege escalation through controlled memory corruption. The exploitability is enhanced because ADX files are commonly used in gaming applications and multimedia production workflows, making these attack vectors highly relevant in practical scenarios.
Mitigation strategies should prioritize immediate version updates to FFmpeg 8.1.3 or later where the vulnerability has been addressed through proper synchronization of channel state variables during mid-stream header re-parsing operations. Organizations should implement robust input validation mechanisms that sanitize audio file headers and detect anomalous channel layout changes before processing. Additionally, deployment of runtime protections such as address space layout randomization, stack canaries, and memory protection features can help mitigate potential exploitation attempts. Security teams should also consider implementing network-based intrusion detection systems to monitor for suspicious ADX file patterns and establish strict content filtering policies for user-generated media uploads. The fix implemented in the patched versions ensures that when AV_PKT_DATA_NEW_EXTRADATA side data is received, the decoder properly updates all internal channel state variables including the prev[] array dimensions before proceeding with subsequent decoding operations, thereby preventing the stale channel count from causing memory access violations. This remediation aligns with ATT&CK technique T1203 by addressing the underlying memory corruption vulnerability that could enable privilege escalation or system compromise through crafted media file inputs.