FFmpeg up to 8.1.2 vf_floodfill video filter filter_frame out-of-bounds write

Summaryinfo

A vulnerability marked as critical has been reported in FFmpeg up to 8.1.2. The impacted element is the function filter_frame of the component vf_floodfill video filter. Performing a manipulation results in out-of-bounds write. This vulnerability is known as CVE-2026-65705. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in FFmpeg up to 8.1.2. It has been classified as critical. This affects the function filter_frame of the component vf_floodfill video filter. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.

The advisory is shared at code.ffmpeg.org. This vulnerability is uniquely identified as CVE-2026-65705 since 07/22/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Applying the patch f186c50cf53aec20e9a29059cb22ca3f2d59201c is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Multimedia Processing Software

Name

• FFmpeg

Version

• 8.1.0
• 8.1.1
• 8.1.2

License

• open-source

Website

• Product: https://ffmpeg.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion