{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/ffmpeg-through-8.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-66036"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (through 8.1.2)"],"_cs_severities":["high"],"_cs_tags":["ffmpeg","vulnerability","heap-corruption","code-execution","dos"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eFFmpeg, a widely used multimedia framework, is affected by a critical heap out-of-bounds write vulnerability, identified as CVE-2026-66036, impacting versions up to and including 8.1.2. The flaw resides within the \u003ccode\u003evf_hqdn3d\u003c/code\u003e filter. An attacker can exploit this by crafting a malicious video file where the frame resolution progressively increases. When this video is processed by a vulnerable FFmpeg instance with the \u003ccode\u003e-reinit_filter 0\u003c/code\u003e option enabled (which disables filtergraph reinitialization), the \u003ccode\u003evf_hqdn3d.config_input()\u003c/code\u003e function allocates undersized buffers based on the initial, smaller frame. Subsequent processing of larger frames by the \u003ccode\u003edenoise_spatial()\u003c/code\u003e function then attempts to write data beyond these allocated boundaries, resulting in heap memory corruption. This vulnerability can lead to denial of service through application crashes or, potentially, arbitrary code execution, posing a significant risk to systems processing untrusted video content.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious video file specifically designed for the \u003ccode\u003evf_hqdn3d\u003c/code\u003e filter, where the resolution of video frames increases after the initial frame.\u003c/li\u003e\n\u003cli\u003eThe malicious video file is delivered to a victim's system, potentially via email attachments, malicious downloads, or by embedding it on a compromised website.\u003c/li\u003e\n\u003cli\u003eA victim's application or service uses a vulnerable version of FFmpeg (through 8.1.2) to process the malicious video.\u003c/li\u003e\n\u003cli\u003eThe FFmpeg process executes with the \u003ccode\u003e-reinit_filter 0\u003c/code\u003e option for the \u003ccode\u003evf_hqdn3d\u003c/code\u003e filter, which prevents dynamic reallocation of buffers for changing frame sizes.\u003c/li\u003e\n\u003cli\u003eDuring the processing of the initial, smaller frame, the \u003ccode\u003evf_hqdn3d.config_input()\u003c/code\u003e function allocates memory buffers for line-history based on this initial frame's width.\u003c/li\u003e\n\u003cli\u003eAs FFmpeg proceeds to process subsequent frames with higher resolutions, the \u003ccode\u003edenoise_spatial()\u003c/code\u003e function attempts to write data for these larger frames.\u003c/li\u003e\n\u003cli\u003eDue to the undersized, pre-allocated buffers, \u003ccode\u003edenoise_spatial()\u003c/code\u003e writes past the allocated memory boundary, causing a heap out-of-bounds write.\u003c/li\u003e\n\u003cli\u003eThis memory corruption leads to an application crash (denial of service) or, with precise exploitation, could allow an attacker to achieve arbitrary code execution on the compromised system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-66036 can lead to severe consequences, primarily encompassing denial of service (DoS) due to application crashes. In more advanced scenarios, it could enable arbitrary code execution, allowing an attacker to gain control over the affected system. While specific victim counts or targeted sectors are not detailed in the source, any organization or individual processing untrusted video files with vulnerable FFmpeg versions is at risk. This includes media processing platforms, video hosting services, content delivery networks, and desktop users utilizing FFmpeg-dependent applications. The CVSS v3.1 base score of 8.8 reflects the high severity and potential for critical impact.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-66036 by updating FFmpeg to a version beyond 8.1.2 or applying commit \u003ccode\u003e5d7112c\u003c/code\u003e immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization for all video files processed by FFmpeg, especially from untrusted sources, to mitigate crafted input.\u003c/li\u003e\n\u003cli\u003eMonitor FFmpeg process logs for crashes, segmentation faults, or other abnormal termination events, which could indicate attempted exploitation or system compromise.\u003c/li\u003e\n\u003cli\u003eReview configurations to minimize usage of the \u003ccode\u003e-reinit_filter 0\u003c/code\u003e option with the \u003ccode\u003evf_hqdn3d\u003c/code\u003e filter when processing untrusted content.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T20:19:22Z","date_published":"2026-07-24T20:19:22Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-heap-oob-write/","summary":"A heap out-of-bounds write vulnerability exists in FFmpeg through version 8.1.2, specifically within the vf_hqdn3d filter, allowing attackers to corrupt heap memory by providing a crafted video input where frame resolution increases between frames while filtergraph reinitialization is disabled, leading to undersized buffers and a write beyond allocation boundaries.","title":"FFmpeg Heap Out-of-Bounds Write Vulnerability (CVE-2026-66036)","url":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-heap-oob-write/"}],"language":"en","title":"CraftedSignal Threat Feed - FFmpeg (Through 8.1.2)","version":"https://jsonfeed.org/version/1.1"}