FFmpeg CVE-2026-66040

The vulnerable code path is reached only when FFmpeg encodes a PNG or APNG file and the input carries an eXIf chunk containing multiple IFD entries that alias (reference) the same large value payload at the same TIFF offset. Exploitation therefore requires the attacker to control or inject content that FFmpeg subsequently encodes into PNG/APNG format - the most common exposure being a web service or pipeline that accepts user-uploaded images and re-encodes them with FFmpeg. The CVSS UI:P signal confirms some form of indirect triggering (a user or automated process invoking FFmpeg on attacker input) rather than a fully autonomous exploit. Factors that limit exploitation: FFmpeg must be invoked in an encoding (write) path, not just decoding; the eXIf chunk must survive any pre-processing steps; and the aliased IFD structure must be preserved through any normalisation layers before reaching add_exif_profile_size(). Deployments that do not encode PNG/APNG output, or that strip EXIF before encoding, are not affected.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P) is broadly consistent with the technical description: network-accessible, low complexity, no privileges, but user interaction required to cause FFmpeg to process the crafted file. The VC:H/VI:H/VA:H impact metrics reflect the deterministic heap corruption. SSVC rates automatable as 'no' - consistent with the UI:P signal - while Technical Impact is 'total', aligning with the RCE potential. EPSS at 0.55% (43rd percentile) indicates low current exploitation activity, and there is no CISA KEV entry or public exploit. The mismatch between SSVC 'total' impact and low EPSS is explained by the requirement for user interaction: FFmpeg must actually be invoked on attacker-supplied input. In batch media transcoding pipelines or web services that accept user-uploaded images and re-encode them, that user-interaction bar can be programmatically crossed, converting the theoretical risk into an operationally viable one. The deterministic nature of the corruption (noted by VulnCheck) is a differentiating factor - heap overflows of this magnitude are often exploitable without heap spray on systems lacking mature mitigations.

An attacker uploads a crafted PNG image to a web service that accepts user content and re-encodes it using FFmpeg (e.g., a thumbnail generator or media platform transcoder). The PNG contains an eXIf chunk with dozens of IFD entries all pointing to the same large offset payload; when FFmpeg's PNG encoder serialises this canonically, it writes tens of thousands of bytes past the heap buffer boundary. Depending on heap layout and platform mitigations, this causes a process crash or, in a favourable heap arrangement, overwrites adjacent allocations to gain code execution within the FFmpeg worker process. No public exploit exists at time of analysis, but VulnCheck's advisory notes the corruption is deterministic, lowering the reliability bar for weaponisation.