Out-of-Bounds Write Vulnerability in FFmpeg by FFmpeg Project

CVE-2026-65704

What is CVE-2026-65704?

FFmpeg before version 8.1.2 is susceptible to an out-of-bounds write vulnerability caused by the TY demuxer's handling of audio packets in a crafted ffconcat file. Attackers can exploit this flaw by supplying a specially crafted file processed with the -safe 0 flag. The vulnerability arises when the demux_audio() function improperly decrements the packet size without adequate bounds checking, leading to a negative size value. This negative value is then passed to the memcpy() function in shorten_decode_frame(), causing the size_t conversion to wrap the value to near SIZE_MAX, which can result in unintended reads and writes beyond the allocated buffer. This could potentially lead to heap corruption, making systems running vulnerable versions of FFmpeg at risk.

References