Skip to main content

FFmpeg CVE-2026-65705

| EUVDEUVD-2026-48372 HIGH
Out-of-bounds Write (CWE-787)
2026-07-23 VulnCheck GHSA-gf7r-r5xq-r3hm
RCE Buffer Overflow Memory Corruption Ffmpeg
7.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.3 HIGH
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.0 HIGH

Local file-processing vector (AV:L) with victim interaction (UI:R); AC:H reflects the required non-default -reinit_filter 0 plus an upward frame-size change; impacts high given potential code execution.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 23, 2026 - 19:47 vuln.today
CVE Published
Jul 23, 2026 - 19:00 cve.org
HIGH 7.3

DescriptionCVE.org

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.

AnalysisAI

Out-of-bounds heap write in FFmpeg's vf_floodfill video filter (versions 3.4 through 8.1.2) lets an attacker corrupt heap memory by feeding a specially crafted, dynamically sized video stream to a filtergraph where reinitialization is disabled via -reinit_filter 0. Reported by VulnCheck with a vendor patch available and no public exploit identified at time of analysis, the flaw reliably crashes the process and carries potential for code execution depending on heap layout and process hardening. Exploitation is local and requires the victim to process attacker-supplied media through the specific floodfill configuration.

Technical ContextAI

The vulnerability lives in libavfilter's vf_floodfill filter, which implements a flood-fill operation by maintaining a stack of pixel points to traverse. During config_input() the traversal stack is sized once based on the dimensions of the initial frame. Normally FFmpeg reinitializes filters when frame geometry changes, but with -reinit_filter 0 this safety reinitialization is suppressed, so a subsequent larger frame is processed against a stack allocation sized for the smaller original frame. filter_frame() then pushes flood-fill neighbor coordinates past the end of that allocation, producing the CWE-787 out-of-bounds write. The affected component is the FFmpeg multimedia framework itself (cpe:2.3:a:ffmpeg:ffmpeg), the near-universal library and CLI used for transcoding and video processing across countless applications and pipelines.

RemediationAI

Patch available per vendor advisory: apply the upstream FFmpeg fix committed at https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c (merged via PR https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780) and rebuild or upgrade to a release that incorporates it; a released patched version number was not independently confirmed from the provided data, so verify the fixed tag against the VulnCheck advisory before deploying. As a compensating control until patched, avoid using -reinit_filter 0 together with the floodfill filter so FFmpeg's normal filtergraph reinitialization re-sizes the traversal stack on frame-geometry changes - the trade-off is a minor reinitialization cost when input dimensions vary. Where the floodfill filter is not needed, remove it from filtergraphs entirely, and process untrusted media in a sandboxed or resource-limited context to contain any heap corruption.

More in Ffmpeg

View all
CVE-2016-1897 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
CVE-2017-9993 HIGH
7.5 Jun 28

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
CVE-2016-1898 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
CVE-2013-4265 CRITICAL POC
10.0 Nov 23

The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
CVE-2020-12284 CRITICAL POC
9.8 Apr 28

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
CVE-2026-58049 HIGH POC
8.8 Jun 28

Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
CVE-2021-38094 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
CVE-2021-38093 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
CVE-2021-38092 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
CVE-2021-38091 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
CVE-2021-38090 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
CVE-2021-30123 HIGH POC
8.8 Apr 07

FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

CVE-2026-65705 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy