Signed Integer Overflow in FFmpeg's MACE6 Audio Decoder

CVE-2026-66039

What is CVE-2026-66039?

FFmpeg versions up to 8.1.2 are affected by a signed integer overflow vulnerability in the MACE6 audio decoder. This flaw arises when processing maliciously crafted CAF (Core Audio Format) files, specifically through oversized values for bytes_per_packet and frames_per_packet in the desc chunk. Attackers can exploit this vulnerability to induce an integer overflow during the sample count computation in the mace_decode_frame() function, leading to an undersized buffer allocation. This misallocation can result in a heap out-of-bounds write, potentially allowing an attacker to execute arbitrary code.

References