CVE-2026-66039 in FFmpeg
Summary
by MITRE • 07/24/2026
FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability resides within FFmpeg's MACE6 audio decoder implementation, specifically in how it processes CAF (Core Audio Format) files containing maliciously crafted metadata. This issue manifests as a signed integer overflow during the computation of output sample counts within the mace_decode_frame() function, creating a critical memory corruption scenario that can be exploited remotely through crafted input files. The vulnerability is particularly concerning because it allows attackers to manipulate heap memory layout through carefully constructed values in the desc chunk of CAF files.
The technical flaw occurs when the decoder processes the bytes_per_packet and frames_per_packet fields within the audio description chunk, where attackers can set these values to exceed the maximum representable signed integer value. When the decoder performs arithmetic operations to calculate the output buffer size, the overflow results in a significantly smaller allocated buffer than required for actual decoding operations. This fundamental miscalculation leads to heap-based out-of-bounds memory writes that can overwrite adjacent memory regions, potentially corrupting program state or enabling arbitrary code execution.
The operational impact of this vulnerability extends across numerous applications and systems that rely on FFmpeg for audio processing, including media players, content management systems, streaming platforms, and digital asset management solutions. Any application that accepts CAF file inputs without proper validation becomes a potential target for exploitation, particularly in environments where users can upload or import media files. The vulnerability's remote exploitability means that attackers can compromise systems simply by enticing victims to process maliciously crafted audio files, making it particularly dangerous in web-based applications and content delivery networks.
This vulnerability aligns with CWE-190, which specifically addresses signed integer overflow conditions, and maps to ATT&CK technique T1203, involving exploitation of software vulnerabilities for code execution. The flaw demonstrates how seemingly innocuous metadata fields in audio file formats can be weaponized through integer arithmetic manipulation, highlighting the importance of robust input validation and memory safety practices in multimedia processing libraries. Organizations should prioritize immediate patching of affected FFmpeg versions to mitigate this risk, while also implementing additional safeguards such as strict input validation for audio file formats and sandboxed processing environments for untrusted media content.
The exploitation scenario requires attackers to craft a CAF file with carefully calculated values that trigger the integer overflow during the decoding process. The resulting heap corruption can manifest in various ways including application crashes, data corruption, or full privilege escalation depending on memory layout and system configuration. Given FFmpeg's widespread adoption across operating systems, media frameworks, and enterprise applications, this vulnerability presents a substantial risk to digital infrastructure security and requires urgent attention from system administrators and security teams across affected organizations.