CVE-2026-66041 in FFmpeg
Summary
by MITRE • 07/24/2026
FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability under discussion represents a critical heap out-of-bounds write flaw affecting FFmpeg versions 7.0 through 8.1.2, specifically within the vf_quirc filter component that processes PGS/SUP subtitle files. This security weakness stems from inadequate bounds checking during image buffer management when handling subtitle presentations with mismatched frame dimensions. The issue manifests when an attacker crafts a malicious subtitle file where the second presentation frame contains larger dimensions than the first, creating a scenario where memory corruption becomes inevitable during the image copying process.
The technical exploitation mechanism involves the av_image_copy_plane() function which fails to validate that the source data dimensions align with the pre-allocated destination buffer size. When processing PGS/SUP files, FFmpeg initializes a grayscale image buffer using libquirc library functions based on the first frame's dimensions. However, when subsequent frames contain larger dimensions, the copy operation attempts to write beyond the allocated heap memory boundaries, leading to unauthorized memory modifications that can overwrite adjacent heap allocations and corrupt program state.
This vulnerability directly maps to CWE-787, which defines out-of-bounds write conditions where an application writes data past the end of a buffer, and aligns with ATT&CK technique T1203, specifically targeting application exploitation through memory corruption vulnerabilities. The operational impact extends beyond simple process crashes to potentially enable remote code execution when attackers can control the input parameters and leverage the heap corruption for arbitrary code execution within the FFmpeg process context.
The security implications are particularly severe given FFmpeg's widespread adoption across multimedia applications, streaming platforms, and content processing systems that handle user-provided media files. Any application utilizing FFmpeg for subtitle processing becomes vulnerable to this attack vector when processing untrusted PGS/SUP files, creating potential for privilege escalation and system compromise. The vulnerability exists in the filter chain specifically designed for QR code detection and decoding, making it particularly dangerous in environments where automated media processing systems handle unverified content from multiple sources.
Mitigation strategies must address both immediate and long-term security considerations for affected systems. Organizations should immediately upgrade to FFmpeg versions containing the fix referenced in commit 4da9812, which implements proper bounds checking and dynamic buffer reallocation when frame dimensions change between presentations. Additionally, input validation mechanisms should be enhanced to reject subtitle files with inconsistent dimension sequences before processing begins. Network-based protections can include implementing strict file format validation and content scanning to identify potentially malicious PGS/SUP files. The fix demonstrates proper defensive programming principles by ensuring that buffer allocations accommodate the maximum possible data size rather than assuming fixed dimensions, thereby preventing the heap corruption scenario that enables exploitation.