Libav: FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat… (CVE-2026-65704)

The vulnerability in FFmpeg (libav) versions up to 8.1.2 involves an out-of-bounds write in the TY demuxer's demux_audio() function. When a specially crafted ffconcat file is processed with the -safe 0 flag, improper bounds checking allows a negative packet size to be passed to memcpy(), resulting in heap corruption. This flaw can lead to potential denial of service or code execution impacts. The issue is tracked as CVE-2026-65704 and has a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Multiple Ubuntu package versions are affected. A patch is available to remediate the vulnerability.

Successful exploitation of this vulnerability can cause heap corruption, which may lead to denial of service or potentially allow an attacker to execute arbitrary code with user-level privileges. The attack requires processing a crafted ffconcat file with the -safe 0 flag, which implies user interaction or specific command-line usage. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

A patch is available for this vulnerability. Users and administrators should apply the official updates provided for FFmpeg/libav to versions later than 8.1.2 or the corresponding fixed package versions in their distributions. Until patched, avoid processing untrusted ffconcat files with the -safe 0 flag to mitigate risk.