Vulnerability Description
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ffmpeg | Ffmpeg | >= 3.4, <= 8.1.2 |
Related Weaknesses (CWE)
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d5Patch
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780Issue TrackingPatch
- https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-viaThird Party Advisory
FAQ
What is CVE-2026-65705?
CVE-2026-65705 is a vulnerability with a CVSS score of 7.8 (HIGH). FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stre...
How severe is CVE-2026-65705?
CVE-2026-65705 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-65705?
Check the references section above for vendor advisories and patch information. Affected products include: Ffmpeg Ffmpeg.