CVE-2026-65705

Name
CVE-2026-65705
Description
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c
disclosure@vulncheck.com https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780
disclosure@vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* ffmpeg >= 3.4 <= 8.1.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
ffmpeg edge-community 8.1.2-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.1.2-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.1.1-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.1.1-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.1-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.1-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0.1-r3 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0.1-r2 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0.1-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0.1-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0-r4 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0-r3 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0-r2 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 8.0-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 7.1.2-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 7.1.1-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 7.1.1-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r10 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r9 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r8 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r7 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r6 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r27 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r26 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r25 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r24 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r23 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r22 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r21 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r20 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r19 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r18 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r17 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r16 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r15 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r14 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r13 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r12 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r10 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r9 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r8 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r7 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r6 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 6.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r9 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r8 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r7 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r6 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0.1-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 5.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ffmpeg edge-community 4.3.2-r0 None possibly vulnerable
ffmpeg edge-community 4.3.1-r0 None possibly vulnerable
ffmpeg edge-community 4.3-r0 None possibly vulnerable
ffmpeg edge-community 4.2.1-r0 None possibly vulnerable
ffmpeg edge-community 4.2-r0 None possibly vulnerable
ffmpeg edge-community 4.1.4-r0 None possibly vulnerable
ffmpeg edge-community 4.1.3-r0 None possibly vulnerable
ffmpeg edge-community 4.1.1-r0 None possibly vulnerable
ffmpeg edge-community 4.1-r0 None possibly vulnerable
ffmpeg edge-community 4.0.2-r0 None possibly vulnerable
ffmpeg edge-community 4.0.1-r0 None possibly vulnerable
ffmpeg edge-community 4.0.0-r0 None possibly vulnerable
ffmpeg edge-community 3.4.4-r0 None possibly vulnerable
ffmpeg edge-community 3.4.3-r0 None possibly vulnerable
ffmpeg 3.24-community 8.1.2-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
ffmpeg 3.24-community 8.1.1-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable