Loading story…
FFmpeg through version 8.1.2 is affected by CVE-2026-66039, a high-severity flaw in the MACE6 audio decoder that can be triggered with a crafted CAF file. The vulnerability stems from a signed integer overflow in mace_decode_frame() when attacker-controlled bytes_per_packet and frames_per_packet values are parsed from the file's desc chunk, causing the decoder to miscalculate output sample counts.
The overflow can lead to an undersized heap allocation followed by a heap out-of-bounds write, creating a path to memory corruption and possible code execution in contexts where a user opens or processes a malicious media file. The issue is mapped to CWE-190 and CWE-122, carries a CVSS v3.1 rating of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and was fixed in FFmpeg commit aafb5c655edc76a753275c383ebb139feb032718, which rejects sample counts that overflow int.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A vulnerability affecting FFmpeg through version 8.1.2 was disclosed as CVE-2026-66039. The issue is a signed integer overflow in the MACE6 audio decoder that can be triggered by a crafted CAF file, causing an undersized allocation and heap out-of-bounds write with possible code execution impact.
FFmpeg committed a fix titled "avcodec/mace: reject sample counts that overflow int," addressing the MACE6 audio decoder flaw later tracked as CVE-2026-66039. The fix is identified as commit aafb5c655edc76a753275c383ebb139feb032718.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcecode.ffmpeg.org
Open sourcecode.ffmpeg.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability, **CVE-2026-70632**, was disclosed in **FFmpeg** affecting versions **4.4 through before 9.0**. The flaw is a **heap out-of-bounds write** in the native GoPro CineForm HD (**CFHD**) decoder that can be triggered when FFmpeg probes a crafted **AVI** file. The bug occurs in `cfhd_decode()` because the transform-type-2 reconstruction path does not properly enforce output-width limits for non-Bayer data, allowing `horiz_filter_clip()` to write past the allocated frame buffer.
Aug 7, 2026
A high-severity vulnerability tracked as **CVE-2026-58049** affects FFmpeg’s RASC video decoder in `libavcodec/rasc.c`, where the `decode_dlta()` function performs 32-bit reads and writes before enforcing a row-boundary check. The flaw is compounded by validating the DLTA region in pixel units rather than byte units, allowing a crafted media stream using the RASC FourCC to access several bytes past a PAL8 frame row allocation. Security advisories say the bug can trigger a bitstream-controlled heap out-of-bounds write and an adjacent out-of-bounds read during decoding, leading to memory corruption and potential remote exploitation. A public proof of concept demonstrates the issue on FFmpeg upstream code and shows how DLTA run handlers can write past a 64-byte PAL8 frame row boundary. The PoC uses a custom buffer callback to place a function pointer next to the frame buffer, then overwrites the low bytes of that pointer through a crafted DLTA run to redirect execution, while AddressSanitizer reports a heap-buffer-overflow in `decode_dlta()`. Reported mitigations include updating FFmpeg, applying vendor patches, and moving row-boundary validation ahead of every 32-bit access with stricter checks such as ensuring `cx + 4 <= w * s->bpp`.
Jul 12, 2026
FFmpeg patched **CVE-2026-8461**, a high-severity heap out-of-bounds write flaw dubbed **PixelSmash** in the `libavcodec` **MagicYUV** decoder. The bug is triggered by an odd `slice_height` condition while parsing malicious **AVI**, **MKV**, or **MOV** files and affects FFmpeg versions before **8.1.2**. The vulnerability can cause denial of service and, in some environments, lead to remote code execution. JFrog reported that applications embedding FFmpeg are exposed through their media-processing pipelines, and demonstrated full remote code execution against **Jellyfin 10.11.9** via its automated media library scan workflow, although successful RCE required **ASLR** to be disabled or bypassed. **Nextcloud** was also identified as potentially vulnerable under additional conditions, while **Plex** appears largely protected by a restricted custom FFmpeg build. Organizations using FFmpeg directly or through downstream products have been urged to upgrade to **FFmpeg 8.1.2 or later** and apply vendor patches because the decoder’s broad adoption creates a notable supply-chain exposure.
Jul 30, 2026