Signed Integer Overflow in FFmpeg's Handling of HEIF ispe Box

CVE-2026-96611

What is CVE-2026-96611?

A signed integer overflow vulnerability exists in FFmpeg's handling of the HEIF ispe box prior to version 9.0. This flaw arises in the mov_read_ispe() function, where width and height values sourced from a crafted HEIF file's ispe box are stored in signed integer fields without proper bounds checking. This inadequacy allows crafted values exceeding the maximum limit for signed integers (INT_MAX) to be improperly processed, resulting in negative values. In the read_image_grid() function, these erroneous values lead to accumulation, causing undefined behavior as specified by C17 section 6.5. On x86 architectures, this can trigger a wraparound, producing small positive values that can bypass critical validity checks downstream, potentially impacting application stability and security.

References