CVE-2026-65704

Name
CVE-2026-65704
Description
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7
disclosure@vulncheck.com https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767
disclosure@vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* ffmpeg >= None <= 8.1.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
ffmpeg edge-community 8.1.2-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.1.2-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.1.1-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.1.1-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.1-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.1-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0.1-r3 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0.1-r2 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0.1-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0.1-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0-r4 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0-r3 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0-r2 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 7.1.2-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 7.1.1-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 7.1.1-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r10 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r9 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r8 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r7 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r6 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r27 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r26 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r25 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r24 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r23 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r22 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r21 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r20 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r19 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r18 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r17 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r16 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r15 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r14 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r13 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r12 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r10 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r9 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r8 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r7 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r6 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r9 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r8 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r7 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r6 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0.1-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.3.2-r0 None possibly vulnerable
ffmpeg edge-community 4.3.1-r0 None possibly vulnerable
ffmpeg edge-community 4.3-r0 None possibly vulnerable
ffmpeg edge-community 4.2.1-r0 None possibly vulnerable
ffmpeg edge-community 4.2-r0 None possibly vulnerable
ffmpeg edge-community 4.1.4-r0 None possibly vulnerable
ffmpeg edge-community 4.1.3-r0 None possibly vulnerable
ffmpeg edge-community 4.1.1-r0 None possibly vulnerable
ffmpeg edge-community 4.1-r0 None possibly vulnerable
ffmpeg edge-community 4.0.2-r0 None possibly vulnerable
ffmpeg edge-community 4.0.1-r0 None possibly vulnerable
ffmpeg edge-community 4.0.0-r0 None possibly vulnerable
ffmpeg edge-community 3.4.4-r0 None possibly vulnerable
ffmpeg edge-community 3.4.3-r0 None possibly vulnerable
ffmpeg edge-community 3.3.4-r0 None possibly vulnerable
ffmpeg 3.24-community 8.1.2-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg 3.24-community 8.1.1-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable