{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/video-processing/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-65706"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg versions 3.0 through 8.1.2"],"_cs_severities":["high"],"_cs_tags":["vulnerability","RCE","out-of-bounds-write","video-processing","FFmpeg"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eA critical out-of-bounds write vulnerability, identified as CVE-2026-65706, affects FFmpeg versions 3.0 through 8.1.2. This flaw resides within the \u003ccode\u003evf_swaprect\u003c/code\u003e video filter, specifically impacting how it handles NV12 video frames with odd width dimensions. Threat actors can exploit this by supplying a specially crafted video frame, causing the \u003ccode\u003efilter_frame()\u003c/code\u003e function to perform an 18-byte \u003ccode\u003ememcpy\u003c/code\u003e operation into a 17-byte heap allocation. This discrepancy, stemming from incorrect temporary buffer sizing for interleaved chroma planes, leads to heap corruption and a subsequent process crash. Successful exploitation can enable remote code execution, granting attackers unauthorized control over the affected system. This vulnerability poses a significant risk to applications and services utilizing vulnerable FFmpeg versions for video processing, as it can be triggered by merely processing a malicious video file or stream.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious NV12 video frame designed with odd width dimensions.\u003c/li\u003e\n\u003cli\u003eThe crafted video frame includes specially structured data intended to trigger an out-of-bounds write condition.\u003c/li\u003e\n\u003cli\u003eThe victim's system, running a vulnerable FFmpeg version (3.0 through 8.1.2), processes the attacker-supplied malicious NV12 video frame.\u003c/li\u003e\n\u003cli\u003eThe FFmpeg \u003ccode\u003evf_swaprect\u003c/code\u003e video filter's \u003ccode\u003efilter_frame()\u003c/code\u003e function is invoked to process the crafted frame.\u003c/li\u003e\n\u003cli\u003eDuring the processing of the two-byte-per-sample interleaved chroma plane, the \u003ccode\u003efilter_frame()\u003c/code\u003e function reuses a temporary row buffer sized for plane 0's single-byte pixel step.\u003c/li\u003e\n\u003cli\u003eThis incorrect sizing causes an 18-byte \u003ccode\u003ememcpy\u003c/code\u003e operation to occur into a 17-byte heap allocation, triggering an out-of-bounds write.\u003c/li\u003e\n\u003cli\u003eThe out-of-bounds write corrupts heap memory, leading to a process crash of the FFmpeg application or service.\u003c/li\u003e\n\u003cli\u003eWith sophisticated crafting, this heap corruption can be exploited to achieve arbitrary code execution, allowing the attacker to gain control over the affected FFmpeg process and potentially the underlying system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65706 results in heap memory corruption, leading to denial of service through application crashes. The vulnerability carries a high CVSS v3.1 base score of 7.8, indicating significant severity. The primary risk is the potential for remote code execution, which would allow an attacker to execute arbitrary commands and take complete control of the system running the vulnerable FFmpeg software. This could lead to data exfiltration, further network compromise, or the installation of additional malicious software. Any application or service that uses FFmpeg for video processing, including media players, video conferencing tools, transcoding services, and content management systems, is at risk. The number of potential victims is vast due to the widespread use of FFmpeg across various industries.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-65706 immediately by upgrading FFmpeg to a version beyond 8.1.2 that addresses this vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor systems for unexpected process crashes related to FFmpeg or media processing applications to detect potential exploitation attempts of CVE-2026-65706.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T20:22:25Z","date_published":"2026-07-23T20:22:25Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-oob-write/","summary":"A critical out-of-bounds write vulnerability (CVE-2026-65706) exists in FFmpeg versions 3.0 through 8.1.2 within the vf_swaprect video filter, allowing attackers to corrupt heap memory and achieve potential remote code execution by providing a specially crafted NV12 video frame with odd width dimensions.","title":"Critical Out-of-Bounds Write Vulnerability in FFmpeg (CVE-2026-65706)","url":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-oob-write/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-65705"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg versions 3.4 through 8.1.2"],"_cs_severities":["high"],"_cs_tags":["cve","vulnerability","out-of-bounds-write","ffmpeg","video-processing"],"_cs_type":"advisory","_cs_vendors":["FFmpeg Project"],"content_html":"\u003cp\u003eFFmpeg versions 3.4 through 8.1.2 are susceptible to a high-severity out-of-bounds write vulnerability, identified as CVE-2026-65705. This flaw resides within the \u003ccode\u003evf_floodfill\u003c/code\u003e video filter component. Attackers can leverage this by crafting a malicious video stream that features dynamically sized frames. When such a stream is processed by \u003ccode\u003effmpeg\u003c/code\u003e with filtergraph reinitialization explicitly disabled (using the \u003ccode\u003e-reinit_filter 0\u003c/code\u003e command-line argument), the \u003ccode\u003efilter_frame()\u003c/code\u003e function attempts to push flood-fill neighbor data beyond the initially allocated memory boundaries. This heap corruption ultimately leads to a process crash, but depending on the heap layout and system hardening measures, it presents a significant risk for remote code execution. This vulnerability affects a wide range of FFmpeg installations, necessitating immediate patching.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious video file specifically designed with dynamically sized frames.\u003c/li\u003e\n\u003cli\u003eThe attacker prepares the execution environment, ensuring that the \u003ccode\u003effmpeg\u003c/code\u003e command will process the malicious video with the \u003ccode\u003e-reinit_filter 0\u003c/code\u003e argument, which disables filtergraph reinitialization.\u003c/li\u003e\n\u003cli\u003eThe victim executes the \u003ccode\u003effmpeg\u003c/code\u003e command with the attacker-provided video file and arguments.\u003c/li\u003e\n\u003cli\u003eFFmpeg begins processing the video, and the \u003ccode\u003evf_floodfill\u003c/code\u003e filter allocates a traversal stack based on the dimensions of the initial frames.\u003c/li\u003e\n\u003cli\u003eA subsequent frame, intentionally larger than the initial frames, is processed by the \u003ccode\u003evf_floodfill\u003c/code\u003e filter.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efilter_frame()\u003c/code\u003e function attempts to write data for flood-fill neighbors beyond the bounds of the original, smaller memory allocation.\u003c/li\u003e\n\u003cli\u003eThis out-of-bounds write corrupts the heap memory of the \u003ccode\u003effmpeg\u003c/code\u003e process.\u003c/li\u003e\n\u003cli\u003eThe heap corruption causes the \u003ccode\u003effmpeg\u003c/code\u003e process to crash, potentially allowing for arbitrary code execution depending on the specific memory layout and system mitigations.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65705 leads to heap memory corruption within the FFmpeg process, causing it to crash. This results in denial of service for any service or application relying on the vulnerable FFmpeg instance for video processing. Crucially, depending on the specifics of the heap layout and the system's process hardening mechanisms, this vulnerability can be escalated to remote code execution. If exploited, an attacker could gain control over the affected system, leading to data compromise, further network intrusion, or the deployment of additional malware. The broad use of FFmpeg across various applications means the potential impact could span numerous sectors and critical systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-65705 immediately by updating all FFmpeg installations to a version beyond 8.1.2.\u003c/li\u003e\n\u003cli\u003eImplement host-based intrusion detection systems to monitor for unusual \u003ccode\u003effmpeg\u003c/code\u003e process crashes or unexpected terminations.\u003c/li\u003e\n\u003cli\u003eConfigure application whitelisting to prevent the execution of \u003ccode\u003effmpeg\u003c/code\u003e with suspicious command-line arguments like \u003ccode\u003e-reinit_filter 0\u003c/code\u003e from untrusted sources.\u003c/li\u003e\n\u003cli\u003eReview and update system hardening configurations to include exploit mitigation techniques such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), which can reduce the likelihood of successful code execution.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T20:21:39Z","date_published":"2026-07-23T20:21:39Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-floodfill-oob-write/","summary":"A critical out-of-bounds write vulnerability exists in FFmpeg versions 3.4 through 8.1.2 within the vf_floodfill video filter, which attackers can exploit by providing a specially crafted, dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0, leading to heap corruption, a process crash, and potentially remote code execution.","title":"Out-of-Bounds Write Vulnerability in FFmpeg vf_floodfill Filter (CVE-2026-65705)","url":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-floodfill-oob-write/"}],"language":"en","title":"CraftedSignal Threat Feed - Video-Processing","version":"https://jsonfeed.org/version/1.1"}