CVE-2026-65704 in FFmpeg
Summary
by MITRE • 07/23/2026
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists within the FFmpeg multimedia framework version 8.1.2 and earlier, representing a critical out-of-bounds write flaw that can be exploited through maliciously crafted ffconcat files. The issue specifically affects the TY demuxer component which processes audio data, creating a pathway for heap corruption that can lead to arbitrary code execution or system instability. The vulnerability is triggered when FFmpeg processes concatenated media files with the -safe 0 flag, which disables safety checks and allows processing of potentially malicious input.
The technical root cause lies in the demux_audio() function within the TY demuxer where packet size values are decremented without proper bounds checking mechanisms. This decrement operation can result in negative integer values that subsequently propagate through the processing pipeline. When these negative values reach the shorten_decode_frame() function, they undergo conversion to size_t data type which causes arithmetic overflow due to unsigned integer wrapping behavior. The resulting value approaches SIZE_MAX, creating a scenario where memcpy() operations attempt to read beyond allocated source buffers and write far beyond the intended Shorten decoder's bitstream buffer boundaries.
The operational impact of this vulnerability is severe as it enables attackers to craft malicious ffconcat files that can trigger heap corruption during normal media processing operations. This allows for potential remote code execution, denial of service attacks, or information disclosure when FFmpeg processes these crafted inputs in applications such as media servers, content management systems, or any software utilizing FFmpeg for multimedia handling. The vulnerability is particularly dangerous because it requires minimal privileges to exploit and can be triggered through standard media processing workflows without requiring special user interaction.
This flaw aligns with CWE-787 (Out-of-bounds Write) and CWE-129 (Improper Validation of Array Index) classifications, demonstrating poor input validation and memory management practices within the multimedia processing pipeline. From an ATT&CK framework perspective, this vulnerability maps to T1059.007 (Command and Scripting Interpreter: PowerShell) and T1203 (Exploitation for Client Execution) through potential remote code execution vectors. The attack surface is broad as FFmpeg is widely integrated into numerous applications, making this vulnerability particularly dangerous in environments where media processing occurs without proper input sanitization.
Mitigation strategies should prioritize immediate patching of FFmpeg to version 8.1.3 or later where the vulnerability has been addressed through bounds checking implementation in the TY demuxer. Organizations should also implement strict input validation for ffconcat files and avoid using the -safe 0 flag in production environments unless absolutely necessary. Additional defensive measures include deploying network segmentation, implementing media file scanning solutions, and utilizing sandboxing techniques to isolate FFmpeg processing operations. System administrators should monitor for suspicious file processing patterns and consider implementing automated patch management systems to ensure rapid deployment of security updates across all affected systems.