FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an… (CVE-2026-66037)

CVE-2026-66037 affects FFmpeg through version 8.1.2 in the IAMF demuxer component. The flaw allows an unauthenticated attacker to cause uncontrolled resource consumption by supplying a crafted count_label field that leads to excessive memory allocation. The root cause is that the mix_presentation_obu() function allocates memory based on attacker-controlled input prior to validating the available data, which can result in multi-gigabyte allocations from very small input files. This can exhaust system memory or cause an out-of-memory kill during format probing. The vulnerability is addressed in a commit identified as 5d7112c, which fixes the issue in versions after 8.1.2.

The vulnerability allows denial of service through resource exhaustion by causing excessive memory allocation. There is no impact on confidentiality or integrity, but availability can be severely affected due to system memory exhaustion or process termination. The CVSS score is 6.5 (medium severity) reflecting the network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on availability.

A fix is available in FFmpeg versions after 8.1.2, specifically in the commit 5d7112c. Users should upgrade to a version that includes this commit to remediate the vulnerability. No other mitigations are specified or required according to the available data.