FFmpeg CVE-2026-66039

User interaction is required (UI:R in CVSS 3.1) - the victim must open or process the malicious CAF file using the vulnerable FFmpeg decoder. No authentication or special privileges are needed to deliver the file, but the victim must use an affected version of FFmpeg with the MACE6 decoder active (default configuration). The attack relies on the decoder's incorrect handling of the desc chunk fields; no additional environmental factors are needed.

CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting network delivery, low complexity, no privileges, but required user interaction, with high impact. EPSS probability is only 0.42% (35th percentile), indicating low likelihood of mass exploitation. No CISA KEV listing or public exploit code has been identified, which suggests no active attacks or weaponized proof-of-concept. In SSVC terms: exploitation is 'none', technical impact is 'total', but user interaction makes automatable exploitation less feasible. While the vulnerability is serious for environments that automatically process CAF files from untrusted sources (e.g., transcoding pipelines), the real-world risk is tempered by the low EPSS and UI requirement. Patch availability further reduces urgency.

An attacker distributes a specially crafted CAF audio file containing malicious bytes_per_packet and frames_per_packet values, e.g., as a media attachment or via a compromised website. When a victim or an automated process opens the file using a vulnerable FFmpeg build, the MACE6 decoder overflows an integer during buffer size calculation, leading to a heap out-of-bounds write and potential arbitrary code execution in the context of the FFmpeg process.