FFmpeg CVE-2026-52295

FFmpeg version 7.0 or later must be used to process a crafted IAMF audio file through the iamf_writer.c encoder/muxer code path, specifically triggering the extradata padding logic with oversized or malformed data. IAMF support must be active (compiled in and invoked), which is the default in FFmpeg builds from v.7.0 onward. Exploitation is strictly limited to denial of service (process crash); no memory disclosure, code execution, or data integrity impact is demonstrated by the available data. In interactive use, a user must open or transcode the crafted file. In server-side pipelines accepting user uploads, the attacker can trigger the crash remotely by submitting the malicious file without needing authenticated access to the server.

The CVSS 6.2 score (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a local denial-of-service with no confidentiality or integrity compromise. The local attack vector (AV:L) is the primary mitigating factor: exploitation requires the attacker to present a crafted IAMF file to FFmpeg, which may occur directly on a desktop or via a server-side automated media processing pipeline. EPSS of 0.17% at the 7th percentile is consistent with a low-to-moderate real-world exploitation probability. No KEV listing and no public exploit code have been identified. For services that accept user-supplied media uploads and transcode them automatically (e.g., video hosting, broadcast tooling), the practical attack surface expands because a remote user can trigger the local crash by submitting a crafted file. For interactive desktop use, a user must explicitly open the crafted file. Overall, this is a genuine but narrow denial-of-service risk, higher priority for unattended media processing pipelines than for general desktop deployments.

An attacker uploads or provides a crafted IAMF audio file with malformed extradata to an automated transcoding service running FFmpeg 7.0+. When FFmpeg processes the file through the iamf_writer.c component, the malformed extradata triggers a buffer overflow during padding operations, corrupting memory and crashing the FFmpeg process. The transcoding service experiences a denial of service; in a pipeline without job isolation, repeated submission of the crafted file could sustainably disrupt the service.