Heap Out-of-Bounds Write Vulnerability in FFmpeg's PNG and APNG Encoders

CVE-2026-66040

What is CVE-2026-66040?

FFmpeg versions up to 8.1.2 are affected by a heap out-of-bounds write vulnerability within the native PNG and APNG encoders. This vulnerability can be exploited by remote attackers who provide a specially crafted PNG image containing a malicious eXIf chunk. The attack manipulates multiple Image File Directory (IFD) entries to reference a single large value payload, leading to a significant increase in the memory output beyond what was allocated. This results in png_write_chunk() writing excessive bytes past the buffer boundary, causing deterministic heap corruption, process crashes, and potentially allowing arbitrary code execution on the affected system.

References