CVE-2026-66036 in FFmpeg
Summary
by MITRE • 07/24/2026
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability resides within FFmpeg's video filtering system, specifically in the vf_hqdn3d filter which implements temporal denoising for video frames. This flaw represents a classic heap buffer overflow condition that occurs when the filter processes video streams with varying frame dimensions without proper reinitialization of internal buffers. The issue manifests when the -reinit_filter 0 option is explicitly set, disabling automatic filtergraph reinitialization and forcing the system to maintain fixed buffer allocations regardless of changing input parameters.
The technical exploitation mechanism involves a carefully crafted video stream where frame resolution increases between successive frames while maintaining the same filter configuration. During initial processing, the vf_hqdn3d.config_input() function determines buffer sizes based on the first frame's width, allocating insufficient memory for subsequent larger frames. This memory allocation mismatch creates a scenario where the denoise_spatial() function attempts to write data beyond the boundaries of pre-allocated line-history buffers, causing heap corruption that can potentially lead to arbitrary code execution or system instability.
This vulnerability directly maps to CWE-787: "Out-of-bounds Write" and aligns with ATT&CK technique T1059.007: "Command and Scripting Interpreter: Python" in scenarios where attackers might leverage such memory corruption for privilege escalation or system compromise. The operational impact extends beyond simple denial of service, as heap corruption can enable attackers to execute malicious code with the privileges of the FFmpeg process, potentially leading to complete system compromise when FFmpeg runs with elevated permissions.
The vulnerability demonstrates a critical design flaw in buffer management within FFmpeg's filtergraph processing pipeline, where dynamic frame size changes are not properly accounted for during filter initialization. Security researchers should note that this issue affects all versions prior to 8.1.3 and requires careful input validation when processing untrusted video content through the affected filter. The recommended mitigation strategy involves either upgrading to FFmpeg version 8.1.3 or later, enabling automatic filtergraph reinitialization, or implementing additional input validation to prevent frame size variations during processing.
The flaw represents a significant risk in multimedia processing environments where FFmpeg handles diverse video inputs from untrusted sources, particularly in streaming services, content management systems, or any application that processes user-uploaded video files. Organizations should prioritize patching this vulnerability while implementing monitoring for anomalous video processing patterns that might indicate exploitation attempts. The memory corruption potential makes this vulnerability particularly dangerous as it can be leveraged for remote code execution in contexts where FFmpeg is invoked with elevated privileges or integrated into larger attack chains targeting multimedia processing infrastructure.
Security professionals should understand that the vulnerability's exploitation requires specific conditions including controlled input video streams and deliberate configuration of filtergraph behavior, but the potential impact makes it a critical concern for organizations relying on FFmpeg for video processing tasks. The fix implemented in commit 5d7112c addresses the root cause by ensuring proper buffer reallocation when frame dimensions change, maintaining memory safety regardless of input variations while preserving the intended filtering functionality.