Vulnerability Description
FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ffmpeg | Ffmpeg | >= 7.0, <= 8.1.2 |
Related Weaknesses (CWE)
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5Patch
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625ExploitPatch
- https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirThird Party Advisory
FAQ
What is CVE-2026-66041?
CVE-2026-66041 is a vulnerability with a CVSS score of 8.8 (HIGH). FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SU...
How severe is CVE-2026-66041?
CVE-2026-66041 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-66041?
Check the references section above for vendor advisories and patch information. Affected products include: Ffmpeg Ffmpeg.