FFmpeg up to 8.1.1 IAMF demuxer libavformat/iamf_parse.c mix_presentation_obu count_label resource consumption

Summaryinfo

A vulnerability classified as problematic was found in FFmpeg up to 8.1.1. This vulnerability affects the function mix_presentation_obu of the file libavformat/iamf_parse.c of the component IAMF demuxer. Such manipulation of the argument count_label leads to resource consumption. This vulnerability is uniquely identified as CVE-2026-66037. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in FFmpeg up to 8.1.1. It has been rated as problematic. Affected by this issue is the function mix_presentation_obu of the file libavformat/iamf_parse.c of the component IAMF demuxer. The manipulation of the argument count_label with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.

The advisory is shared for download at code.ffmpeg.org. This vulnerability is handled as CVE-2026-66037 since 07/23/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 329730 (Linux Distros Unpatched Vulnerability : CVE-2026-66037), which helps to determine the existence of the flaw in a target environment.

Applying the patch 5d7112c is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Tenable (329730). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Multimedia Processing Software

Name

• FFmpeg

Version

• 8.1.0
• 8.1.1

License

• open-source

Website

• Product: https://ffmpeg.org/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion