CVE-2026-66037 in FFmpeg
Summary
by MITRE • 07/24/2026
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability under discussion represents a critical resource consumption flaw in FFmpeg versions up to 8.1.2, specifically within the IAMF demuxer component. This issue stems from inadequate input validation mechanisms that permit attackers to manipulate memory allocation behavior through crafted input files. The vulnerability is particularly concerning because it operates with minimal input requirements, requiring only a 17-byte malicious file to trigger massive memory consumption. The flaw resides in the mix_presentation_obu() function located at libavformat/iamf_parse.c, where the software performs memory allocation based on attacker-controlled data without proper bounds checking or validation of available resources.
The technical execution of this vulnerability involves the use of av_calloc() function with a parameter derived from an attacker-controlled count_label field. This function call occurs before any validation of the actual OBU (OBU = Open Bitstream Unit) data availability, creating a scenario where memory allocation amplification reaches approximately 126 million bytes per input byte. The vulnerability maps directly to CWE-400, which addresses "Uncontrolled Resource Consumption" or "Resource Exhaustion" conditions in software systems. This specific implementation flaw allows for exponential memory consumption that can quickly overwhelm available system resources and potentially cause system instability or complete process termination.
The operational impact of this vulnerability extends beyond simple denial-of-service scenarios, as it represents a significant security risk for any system processing media files through FFmpeg. Attackers can exploit this weakness to consume multi-gigabyte memory allocations from minimal input data, making it particularly dangerous in environments where resource constraints are critical such as web servers, cloud computing platforms, or embedded systems with limited memory capacity. During format probing operations, the vulnerability triggers an out-of-memory condition that can cause the application to terminate unexpectedly, potentially enabling attackers to perform persistent denial-of-service attacks against media processing services.
The mitigation strategy for this vulnerability involves immediate patching of FFmpeg installations to versions containing the fix implemented in commit 5d7112c. System administrators should prioritize updating their FFmpeg deployments as this vulnerability can be exploited remotely without authentication requirements, making it accessible to any attacker who can influence file processing operations. Additionally, implementing input validation controls and resource limits on media processing services can provide defensive measures while awaiting official patches. Organizations should also consider monitoring for unusual memory consumption patterns in systems that process multimedia content, as this vulnerability may manifest through elevated memory usage before causing system instability. From an ATT&CK framework perspective, this vulnerability aligns with techniques involving resource exhaustion and privilege escalation through software exploitation, potentially enabling attackers to disrupt services or gain further system access through successful exploitation of the memory consumption flaw.