Skip to main content
CVE-2026-66041VulnerabilityPublished 07/24/2026Updated 10/17/2026

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker… (CVE-2026-66041)

Affects ffmpegSource GCVE Database

CVSS 3.1 base score
8.8Medium
Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.5% chance of exploitation in 30 days – higher than 41% of CVEs
Patch
Available – fixed in 8.1.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What to do

AI-suggested

Upgrade FFmpeg to version 8.1.3 or later, where the vulnerability has been fixed in commit 4da9812. No other mitigation is indicated by the vendor advisory.

Affected software

ProductAffectedFixed in
GitHub Actionsffmpeg/FFmpegpkg:github/ffmpeg/FFmpegOther threatsAffected
  • 7.0 <8.1.3
Fixed in
  • 8.1.3
Ubuntu:26.10ffmpegpkg:deb/ubuntu/ffmpeg?arch=source&distro=stonkingOther threatsAffected
  • =7:8.0.1-3ubuntu2
  • =7:8.1-3ubuntu3
  • =7:8.1.2-2ubuntu2
Fixed in–
Ubuntu:Pro:26.04:LTSffmpegpkg:deb/ubuntu/ffmpeg?arch=source&distro=esm-apps/resoluteOther threatsAffected
  • =7:7.1.1-1ubuntu4
  • =7:7.1.2-1ubuntu3
  • =7:7.1.2-1ubuntu4
  • =7:7.1.3-1ubuntu1
  • =7:8.0.1-2ubuntu1
  • =7:8.0.1-3ubuntu1
  • =7:8.0.1-3ubuntu2
  • =7:8.0.1-3ubuntu2+esm1
  • =7:8.0.1-3ubuntu2+esm3
  • =7:8.0.1-3ubuntu2+esm4
  • =7:8.0.1-3ubuntu2+esm5
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

FFmpeg versions 7.0 through 8.1.2 contain a heap out-of-bounds write vulnerability in the vf_quirc filter. This vulnerability occurs when processing crafted PGS/SUP subtitle files with mismatched frame dimensions, potentially leading to heap corruption, process crashes, or code execution. The issue is fixed in version 8.1.3 and later.

Weaknesses

References