Out-of-Bounds Memory Access in FFmpeg ADX Audio Decoder

CVE-2026-64835

What is CVE-2026-64835?

An out-of-bounds memory access vulnerability has been identified in the ADX audio decoder of FFmpeg, affecting versions 4.4 through 8.1.2. This flaw occurs when a crafted ADX or AAX audio file is supplied with a mid-stream channel layout change. The issue arises in the adx_decode_frame function where the stream header is re-parsed upon receiving AV_PKT_DATA_NEW_EXTRADATA side data. However, the internal channel state is not updated accordingly, leading to potential out-of-bounds reads and writes on the prev[] state array due to stale channel counts. Attackers can exploit this vulnerability to disrupt the application and possibly execute arbitrary code.

References