EUVD-2026-77134
GHSA-vp63-fqg3-cph4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted MOV file with malformed IACB extradata
-
DeliveryFFmpeg opens and begins MOV parsing
-
Exploitmov_read_iacb() reads past undersized extradata buffer
-
ExecutionOut-of-bounds read triggers
-
ImpactProcess crash / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires FFmpeg to process a crafted MOV file containing an IACB atom where the associated extradata buffer is insufficiently padded. The local attack vector (AV:L) means the malicious file must be delivered as input to the FFmpeg process - via a media ingest queue, direct file path, or piped stream. High attack complexity (AC:H) indicates specific extradata sizing preconditions must be satisfied for the OOB read to trigger. No elevated privileges are required (PR:N) and no interactive user involvement is needed beyond automated file processing (UI:N). The impact is bounded to a process crash (A:L); CVSS explicitly rates C:N and I:N, meaning no confidentiality or integrity impact applies. Exploitation is only meaningful in contexts where FFmpeg processes attacker-influenced or untrusted MOV files. |
| Impact | The CVSS 3.1 base score of 2.9 (Low) with vector AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L accurately characterizes this as a low-severity, low-priority issue. The local attack vector (AV:L) means a crafted MOV file must be processed by FFmpeg, ruling out straightforward remote exploitation. High attack complexity (AC:H) indicates that specific extradata sizing and padding conditions must be met. The impact is confined to a limited availability degradation - a process crash - with no confidentiality or integrity loss per CVSS (C:N/I:N). No EPSS data was included in the input. The vulnerability is not listed in CISA KEV, and no public exploit code has been confirmed in the input data. The primary real-world risk scenario is denial of service in automated media ingest or transcoding pipelines that process untrusted MOV files; for interactive use cases, risk is negligible. Despite FFmpeg's broad deployment, this is a low real-world priority. |
| Exploit ScenarioDerived | An attacker introduces a crafted MOV file - containing an IACB atom with intentionally undersized or unpadded extradata - into an automated FFmpeg-based transcoding or media ingest pipeline. When FFmpeg processes the file, mov_read_iacb() reads past the extradata buffer boundary, triggering a process crash and denying service for that processing job. No public exploit code has been confirmed in the available input data, though a researcher reference exists in the Kenan-Kamel VulnerabilitiesReference repository. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 13, 2026
Out-of-bounds read in FFmpeg's MOV container parser (mov_read_iacb in libavformat/mov.c) crashes the process when handling IACB atoms containing insufficiently padded extradata, affecting all releases before 9.0. The vendor-assigned CVSS score of 2.9 (Low) with AV:L/AC:H reflects a local, high-complexity attack limited to a process crash with no confidentiality or integrity impact. No active exploitation has been identified; an upstream fix is available in FFmpeg 9.0 via commit 8439e020 and PR 22988.
RemediationAI
Upgrade to FFmpeg 9.0 or later, which incorporates the fix via commit 8439e0203744a30d280668fcd086f74ed5001da1 available at https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1. Downstream distributions and projects embedding FFmpeg should backport this commit to any maintained older branches. As a compensating control where immediate upgrade is not feasible, operators running automated MOV ingest pipelines can restrict input sources to trusted origins only, or apply a pre-validation step that rejects MOV files containing IACB atoms; note that this would break legitimate immersive audio content. Sandboxing FFmpeg worker processes (e.g., via seccomp or containerization) limits the blast radius of a crash to a single processing job without requiring a patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FFmpeg is a widely used open-source multimedia framework. The vulnerability resides in libavformat/mov.c in the mov_read_iacb() function, which is responsible for parsing IACB (immersive audio codec box) atoms found in QuickTime/MPEG-4 MOV container files. When the extradata associated with an IACB atom is not sufficiently padded - meaning the allocated or read buffer lacks the required trailing bytes for safe sequential access - the parser reads past the valid buffer boundary, constituting a CWE-125 out-of-bounds read. The affected CPE is cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* covering all FFmpeg releases prior to 9.0. A researcher reference for the issue is documented at the Kenan-Kamel VulnerabilitiesReference repository.
Know when Ffmpeg gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Crafted local file required (AV:L), specific extradata padding conditions needed (AC:H), crash-only impact with no information exposure (C:N/I:N/A:L).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
Memory corruption in FFmpeg before 8.1 allows an attacker who can supply a crafted H.264/HEVC media file to corrupt heap
Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
Exploit-DB