The newly catalogued flaws affect FFmpeg 8.1.2 and, depending on the vulnerability, several older branches. They are especially significant for cloud transcoding services, streaming platforms, social networks, content-management systems and artificial intelligence applications that automatically process files supplied by users.
Security records identify weaknesses across FFmpeg’s decoders, encoders, filters, demuxers and hardware-acceleration components. Several could permit writes outside allocated memory, creating conditions that may crash an application or potentially allow an attacker to execute code within the affected process.
One of the most serious issues, tracked as CVE-2026-64830, is a heap-buffer overflow in the VobSub subtitle demuxer. A specially prepared pair of. sub and. idx files can declare more subtitle stream identifiers than an internal fixed-size array can accommodate. Processing the files may cause data to be written into adjacent heap memory.
The flaw affects FFmpeg versions from 2.1 through 8.1.2 and carries a high severity rating. Successful exploitation requires a targeted file to be processed, but this interaction may occur automatically when an upload service extracts subtitles, metadata or preview images.
A separate vulnerability, CVE-2026-64832, affects the NVIDIA NVDEC hardware decoder used to accelerate video decoding on supported graphics processors. Crafted video content can trigger a double-free condition, in which the software attempts to release the same memory location twice. Such errors can corrupt memory and may become exploitable under favourable conditions.
The NVDEC weakness affects FFmpeg versions 4.4 through 8.1.2. Systems without the relevant NVIDIA decoding path may not be directly exposed to that particular flaw, although installations often contain multiple vulnerable components.
Other defects broaden the potential attack surface beyond conventional video playback. CVE-2026-64833 involves an out-of-bounds read in the S/PDIF muxer. A malicious DTS-HD audio stream can supply a false size value, prompting FFmpeg to read beyond the packet buffer. The result could be a crash or disclosure of data held near the affected memory region.
Information exposure is also possible through CVE-2026-66038 in the LCL/ZLIB video decoder. The decoder can accept a compressed stream that produces less data than expected, then continue copying a complete frame from a partly uninitialised allocation. Output generated during processing could therefore contain fragments of heap memory belonging to the FFmpeg process.
Such leakage may reveal pointer values or other process data that could help an attacker bypass protections including address space layout randomisation. It may also become part of a multi-stage exploit when combined with a separate memory-writing vulnerability.
Additional out-of-bounds write flaws have been identified in FFmpeg video filters. CVE-2026-65705 affects the flood-fill filter when frame dimensions change while automatic filtergraph reinitialisation is disabled. CVE-2026-65706 affects the rectangle-swapping filter when it processes specially formed NV12 frames with odd widths.
CVE-2026-66036 similarly targets the hqdn3d denoising filter through video streams whose resolution changes between frames under particular filter settings. Another weakness affects the native PNG and animated PNG encoders, where malicious metadata can cause heap memory corruption while images are processed.
Not every vulnerable function is enabled or reached in a standard installation. Exploitability depends on build options, command-line parameters, hardware support and the way a downstream application invokes FFmpeg. Public upload portals and unattended conversion systems face greater exposure because attackers can repeatedly submit files without directly operating the affected server.
The risk extends beyond machines where administrators knowingly installed the FFmpeg command-line utility. Its libraries are embedded or bundled in desktop programs, mobile applications, browser components, surveillance platforms, messaging systems and machine-learning services. Statically linked copies may remain hidden from conventional package inventories and may not receive operating-system updates.
Organisations are being advised to identify every deployed FFmpeg instance, including copies packaged inside containers, appliances and third-party applications. Upgrading only the system package may leave bundled binaries unchanged.
The official stable 8.1 branch release listed before these latest disclosures is FFmpeg 8.1.2, released on 17 June. Contrary to claims circulating in some reports, there is no official FFmpeg version 8.1.28. Several July vulnerability notices state that versions through 8.1.2 are affected and point to individual source-code commits as fixes, meaning users may need vendor patches or development builds containing the relevant changes.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
