Attack Chain

1. An attacker crafts a malicious ADX or AAX audio file containing AV_PKT_DATA_NEW_EXTRADATA side data that specifies a mid-stream channel layout change.
2. The crafted audio file is delivered to a victim system or application, often via download, email, or a malicious website.
3. The victim system or application uses a vulnerable FFmpeg version (4.4 through 8.1.2) to process the crafted audio file.
4. During processing, the adx_decode_frame function within libavcodec/adxdec.c encounters the AV_PKT_DATA_NEW_EXTRADATA side data and re-parses the stream header.
5. The adx_decode_frame function fails to correctly update its internal channel state following the re-parsing.
6. Subsequent decoding operations attempt to access the prev[] state array using the outdated (stale) channel count, resulting in an out-of-bounds memory access.
7. This out-of-bounds access can lead to application crashes (denial of service), information disclosure, or, in certain exploit scenarios, arbitrary code execution within the context of the FFmpeg process.

Impact

The successful exploitation of CVE-2026-64835 can lead to severe consequences for systems processing ADX or AAX audio files with vulnerable FFmpeg versions. The out-of-bounds memory access can directly cause the FFmpeg application to crash, resulting in a denial of service for any media processing functionality. Depending on the memory layout and the specifics of the out-of-bounds read/write, this vulnerability could also facilitate information disclosure, allowing attackers to access sensitive data, or, in more advanced scenarios, lead to arbitrary code execution. This could grant an attacker control over the compromised system, making it a critical risk for media processing platforms, content creation tools, and any software relying on FFmpeg for audio decoding.

Recommendation

• Patch CVE-2026-64835 immediately by updating all instances of FFmpeg to a version beyond 8.1.2.
• Implement strict validation and sanitization for all incoming audio files, especially ADX and AAX formats, to prevent the ingestion of crafted malicious files that could trigger CVE-2026-64835.