CVE-2026-66040: FFmpeg Heap Out-of-Bounds Write in PNG/APNG Encoders

A critical heap out-of-bounds write vulnerability, identified as CVE-2026-66040, affects FFmpeg versions up to 8.1.2 within its native PNG and APNG encoders. This flaw allows remote attackers to trigger deterministic heap corruption and process crashes, and potentially achieve arbitrary code execution. Attackers can exploit this by crafting a malicious PNG image containing an eXIf chunk where multiple IFD (Image File Directory) entries refer to the same large value payload. This design causes add_exif_profile_size() to underestimate the required buffer size during canonical serialization, leading to png_write_chunk() writing tens of thousands of bytes beyond the allocated memory boundary. The vulnerability was patched in commit b506faf. Organizations using affected FFmpeg versions are at risk of service disruption and compromise.

Attack Chain

1. An attacker crafts a malicious PNG image that includes a specially formatted eXIf chunk.
2. The eXIf chunk is designed with multiple IFD entries that reference the same large value payload, specifically engineered to trigger a buffer size miscalculation.
3. The crafted PNG image is delivered to a target system, likely through a communication channel or file upload, where FFmpeg through version 8.1.2 is used for image processing or encoding.
4. FFmpeg's native PNG or APNG encoder attempts to process the malicious eXIf chunk during canonical serialization.
5. The internal function add_exif_profile_size() incorrectly calculates and undersizes the memory buffer required for the serialized eXIf data.
6. The png_write_chunk() function proceeds to write the oversized eXIf data to the allocated, undersized buffer.
7. This action results in a heap out-of-bounds write, with tens of thousands of bytes written past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.

Impact

Successful exploitation of CVE-2026-66040 leads to deterministic heap corruption and crashes of any application or service utilizing vulnerable FFmpeg versions for PNG or APNG encoding. This can result in denial of service and instability of critical systems. Furthermore, attackers could leverage the heap corruption to achieve arbitrary code execution, allowing them to gain control over the affected system, exfiltrate data, or deploy additional malicious payloads. While specific victim counts or sectors are not disclosed, any organization processing user-supplied PNG images with affected FFmpeg versions is at risk.

Recommendation

• Patch FFmpeg to a version beyond 8.1.2 (specifically, a version including commit b506faf or later) immediately to remediate CVE-2026-66040.
• Monitor systems utilizing FFmpeg for unexpected process terminations or crashes, which could indicate attempted exploitation of CVE-2026-66040.