Libav: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an… (CVE-2026-66037)
FFmpeg versions up to 8.1.2 contain an uncontrolled resource consumption vulnerability in the IAMF demuxer. This flaw allows an unauthenticated attacker to cause excessive memory allocation by supplying a crafted count_label field, leading to multi-gigabyte allocations from very small input files. The vulnerability arises because the mix_presentation_obu() function allocates memory based on attacker-controlled input before validating available data, potentially exhausting system memory or causing an out-of-memory kill during format probing.
AI Analysis
Technical Summary
CVE-2026-66037 is a resource exhaustion vulnerability in FFmpeg (libav) through version 8.1.2 within the IAMF demuxer. The vulnerability is due to the mix_presentation_obu() function calling av_calloc() with an attacker-controlled count_label value before validating the actual available OBU data. This leads to an allocation amplification of approximately 126 million bytes per input byte, enabling an attacker to trigger multi-gigabyte memory allocations from a crafted 17-byte input file. This can exhaust process memory or cause an out-of-memory kill, impacting availability. The vulnerability was fixed in commit 5d7112c.
Potential Impact
An unauthenticated attacker can cause a denial of service by triggering excessive memory allocation, exhausting system resources or causing the process to be killed due to out-of-memory conditions. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
A fix is available and was introduced in commit 5d7112c, which addresses the uncontrolled resource consumption in the IAMF demuxer. Users should update FFmpeg to a version that includes this commit or later. Since this is not a cloud service, manual patching is required. Patch status is confirmed fixed in the referenced commit. No additional mitigations are specified.
Libav: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an… (CVE-2026-66037)
Description
FFmpeg versions up to 8.1.2 contain an uncontrolled resource consumption vulnerability in the IAMF demuxer. This flaw allows an unauthenticated attacker to cause excessive memory allocation by supplying a crafted count_label field, leading to multi-gigabyte allocations from very small input files. The vulnerability arises because the mix_presentation_obu() function allocates memory based on attacker-controlled input before validating available data, potentially exhausting system memory or causing an out-of-memory kill during format probing.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-66037 is a resource exhaustion vulnerability in FFmpeg (libav) through version 8.1.2 within the IAMF demuxer. The vulnerability is due to the mix_presentation_obu() function calling av_calloc() with an attacker-controlled count_label value before validating the actual available OBU data. This leads to an allocation amplification of approximately 126 million bytes per input byte, enabling an attacker to trigger multi-gigabyte memory allocations from a crafted 17-byte input file. This can exhaust process memory or cause an out-of-memory kill, impacting availability. The vulnerability was fixed in commit 5d7112c.
Potential Impact
An unauthenticated attacker can cause a denial of service by triggering excessive memory allocation, exhausting system resources or causing the process to be killed due to out-of-memory conditions. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
A fix is available and was introduced in commit 5d7112c, which addresses the uncontrolled resource consumption in the IAMF demuxer. Users should update FFmpeg to a version that includes this commit or later. Since this is not a cloud service, manual patching is required. Patch status is confirmed fixed in the referenced commit. No additional mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qqrg-chvw-q8jp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-66037"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a6542289c2644c7f808a004
Added to database: 07/25/2026, 23:09:28 UTC
Last enriched: 08/08/2026, 16:58:21 UTC
Last updated: 09/07/2026, 10:52:10 UTC
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.