CVE-2026-65705 in FFmpeg
Summary
by MITRE • 07/23/2026
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists within FFmpeg's video filtering subsystem where the vf_floodfill filter fails to properly handle dynamic frame size changes during processing. The flaw originates from improper memory management during filtergraph reinitialization, specifically when the -reinit_filter 0 parameter disables automatic reinitialization of filters with changing input parameters. When a video stream initially processes frames of smaller dimensions and subsequently encounters larger frames, the internal stack allocation for floodfill point traversal becomes insufficient.
The technical implementation involves the config_input() function allocating memory for a traversal stack based on initial frame dimensions without accounting for potential size increases in subsequent frames. This static allocation approach creates a fundamental mismatch when filter_frame() processes larger frames that require additional stack space for neighbor point tracking during floodfill operations. The out-of-bounds write occurs when the flood-fill algorithm attempts to push new points onto the pre-allocated stack beyond its original boundaries.
This vulnerability directly maps to CWE-787 Out-of-bounds Write, which is classified under the Common Weakness Enumeration framework as a critical memory safety issue. The operational impact extends beyond simple process crashes to potential code execution scenarios depending on heap memory layout and process security mitigations such as address space layout randomization and data execution prevention. Attackers can exploit this by crafting malicious video streams that trigger the specific sequence of frame size changes leading to the buffer overflow condition.
The attack vector requires control over input video content and knowledge of FFmpeg's internal processing behavior, making it suitable for exploitation in media processing pipelines and content delivery systems. The vulnerability affects multiple FFmpeg versions from 3.4 through 8.1.2, indicating a long-standing issue that persists across major releases. Security researchers have identified this as a critical risk for applications that process untrusted video content using FFmpeg's filtergraph functionality.
Mitigation strategies include updating to patched FFmpeg versions where the memory allocation logic has been corrected to handle dynamic frame size changes properly. The recommended approach involves implementing dynamic stack resizing or pre-allocation based on maximum expected frame dimensions rather than relying on initial frame parameters. Additionally, enabling proper input validation and frame dimension checking within applications using FFmpeg can help detect anomalous processing sequences that might trigger the vulnerability. System hardening measures including stack canaries, heap metadata protection, and process isolation further reduce exploitation risk in environments where patching may not be immediately possible.
Organizations should also implement monitoring for unexpected process crashes or memory corruption patterns when processing video content through FFmpeg components, particularly in high-risk scenarios such as user-uploaded media processing or automated content analysis systems. The vulnerability demonstrates the importance of proper resource management in multimedia processing libraries and highlights the need for comprehensive testing of dynamic allocation scenarios in filter processing pipelines. Security teams should prioritize patching this vulnerability across all systems that utilize FFmpeg for video processing, especially those handling untrusted input streams where arbitrary code execution could lead to complete system compromise.