FFmpeg EUVD-2026-54166

The target must run FFmpeg version 4.4 or later and prior to 9.0 with the native CFHD decoder compiled in, which is the default build configuration for all standard FFmpeg distributions. The crafted AVI file must be processed by FFmpeg - either by a user manually invoking ffmpeg or ffprobe on the file, or by an automated pipeline (transcoder, media server, upload processor) probing the stream. Passive user interaction is required (CVSS 4.0 UI:P): the file must be opened or probed by the FFmpeg process, but no active user steps beyond triggering file processing are needed. No authentication or elevated privileges are required (PR:N). The attack vector is local (AV:L in the CVSS 4.0 vector), meaning the crafted file must be accessible to the FFmpeg process on the local filesystem or a mounted share - purely autonomous remote network exploitation without file delivery and local processing is not possible. The vulnerability is triggered specifically in the transform-type-2 reconstruction path for non-Bayer CFHD content; standard Bayer-mode CineForm content does not trigger the flaw, slightly narrowing the effective trigger surface within the CFHD format. Factors limiting exploitation: the file must reach the local FFmpeg process (requires user action or an exposed automated pipeline), and exploitation of heap corruption to redirect execution depends on heap layout at runtime, which may vary across OS, allocator version, and FFmpeg build configuration.

The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 8.5) assigns a local attack vector with passive user interaction, low attack complexity, no attack requirements, and no privileges required, with High impact across confidentiality, integrity, and availability. The local attack vector reflects that a crafted AVI file must be processed by the local FFmpeg instance - but many FFmpeg deployments in transcoding pipelines, media servers, and upload services process externally sourced files, effectively making user-triggered file processing the only barrier to exploitation. No EPSS score was provided and this CVE is absent from CISA KEV at time of analysis, leaving exploitation likelihood unquantified from probabilistic sources; however, the concrete RCE escalation mechanism (callback pointer overwrite) described in the CVE text elevates the practical risk well above vulnerabilities where code execution is speculative. The extremely broad affected version range (4.4 to <9.0, spanning approximately five years of releases) combined with FFmpeg's prevalence in media infrastructure means the exposed population is large. The absence of a formally tagged stable release fixing the vulnerability - only upstream commits and a PR are referenced - creates deployment risk for packagers relying on distro repositories. No tension between CVSS signals and description was identified, except that the CVE description states 'remote attackers' while AV:L implies local processing; this is consistent with a social-engineering or upload-triggered delivery model rather than a direct network exploit.

An attacker crafts a malicious AVI file with a CFHD-encoded video stream whose transform-type-2 reconstruction parameters specify a logical output width that violates the non-Bayer invariant, causing horiz_filter_clip() to write 16-bit sample rows beyond the heap-allocated output frame buffer during FFmpeg stream probing. The overwrite corrupts a live cleanup callback function pointer on the heap; when the CFHD decoder's cleanup routine invokes the pointer on teardown or error recovery, execution transfers to attacker-controlled memory, achieving arbitrary code execution under the privileges of the FFmpeg process. No public proof-of-concept exploit code has been identified at time of analysis, but the concrete escalation path described in the CVE text - specific function, specific data structure overwritten - substantially reduces the development effort required to weaponize this flaw.