FFmpeg CVE-2026-65704

Exploitation requires the target to process an attacker-supplied ffconcat/concat file with the -safe 0 flag explicitly enabled (the default -safe 1 blocks the referenced-file path), and the referenced content must be a TY container routed to the Shorten (SHN) decoder so that demux_audio() produces the negative size consumed by shorten_decode_frame()'s memcpy(). Limiting factors: the attack vector is local (AV:L) requiring the victim to open or pipeline the malicious file (UI:P user interaction), a specific attack requirement applies (AT:P), and the vulnerable -safe 0 configuration is not the default - so environments that never disable -safe, or never feed untrusted TY/Shorten media, are not exposed.

The CVSS 4.0 score of 7.3 (High) reflects a local vector (AV:L) with passive user interaction (UI:P) and an attack requirement (AT:P), meaning exploitation is not trivial remote-unauthenticated - a victim must process attacker-supplied media with a specifically dangerous flag (-safe 0). Vulnerable-system impact is rated High across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with no scope change to subsequent systems (SC:N/SI:N/SA:N), consistent with heap corruption that can escalate to code execution. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided; the practical prerequisite of the non-default -safe 0 flag plus a crafted TY/Shorten stream meaningfully limits mass exploitation. This is a real memory-corruption issue worth patching, but the -safe 0 dependency makes it more relevant to automated pipelines and services that intentionally disable that guard than to typical default-configuration users.

An attacker crafts a malicious ffconcat playlist referencing a TY container with a manipulated audio packet size and delivers it to a media-processing service or user that runs FFmpeg with the -safe 0 flag. When the file is demuxed, demux_audio() produces a negative packet size that wraps in shorten_decode_frame()'s memcpy(), corrupting the heap beyond the decoder's bitstream buffer and potentially leading to arbitrary code execution. No public exploit has been identified at time of analysis, and successful exploitation depends on the victim invoking the non-default -safe 0 option.