Out-of-Bounds Write Vulnerability in FFmpeg Video Filter

CVE-2026-65705

What is CVE-2026-65705?

FFmpeg versions 3.4 through 8.1.2 are affected by an out-of-bounds write vulnerability in the vf_floodfill video filter. Attackers can exploit this flaw by supplying a dynamically sized video stream while having filtergraph reinitialization set to zero. This situation leads to a corruption of heap memory due to incorrect allocation of the points traversal stack, which is based on the original frame dimensions. When a larger subsequent frame is processed, it results in out-of-bounds accesses, potentially causing crashes and enabling code execution depending on the underlying heap layout and process hardening measures.

References