Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…
EPSS 0.2%top 89%

Libav: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an… (CVE-2026-66037)

0
Medium
Published: 07/24/2026 (07/24/2026, 20:18:00 UTC)
Source: GCVE Database
Product: libav

Description

FFmpeg versions up to 8.1.2 contain an uncontrolled resource consumption vulnerability in the IAMF demuxer. This flaw allows an unauthenticated attacker to cause excessive memory allocation by supplying a crafted count_label field, leading to multi-gigabyte allocations from very small input files. The vulnerability arises because the mix_presentation_obu() function allocates memory based on attacker-controlled input before validating available data, potentially exhausting system memory or causing an out-of-memory kill during format probing.

CVSS v3.1

Score 6.5medium

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected software

GitHub Actionsmore threats →ai
ffmpeg/FFmpeg
pkg:github/ffmpeg/FFmpeg
Affected versions
<8.1.3

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 08/08/2026, 16:58:21 UTC

Technical Analysis

CVE-2026-66037 is a resource exhaustion vulnerability in FFmpeg (libav) through version 8.1.2 within the IAMF demuxer. The vulnerability is due to the mix_presentation_obu() function calling av_calloc() with an attacker-controlled count_label value before validating the actual available OBU data. This leads to an allocation amplification of approximately 126 million bytes per input byte, enabling an attacker to trigger multi-gigabyte memory allocations from a crafted 17-byte input file. This can exhaust process memory or cause an out-of-memory kill, impacting availability. The vulnerability was fixed in commit 5d7112c.

Potential Impact

An unauthenticated attacker can cause a denial of service by triggering excessive memory allocation, exhausting system resources or causing the process to be killed due to out-of-memory conditions. There is no impact on confidentiality or integrity reported.

Mitigation Recommendations

A fix is available and was introduced in commit 5d7112c, which addresses the uncontrolled resource consumption in the IAMF demuxer. Users should update FFmpeg to a version that includes this commit or later. Since this is not a cloud service, manual patching is required. Patch status is confirmed fixed in the referenced commit. No additional mitigations are specified.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Osv Id
GHSA-qqrg-chvw-q8jp
Osv Schema Version
1.4.0
Aliases
["CVE-2026-66037"]
Ecosystems
[]
Database Specific Severity
HIGH
Cvss Version
4.0

Threat ID: 6a6542289c2644c7f808a004

Added to database: 07/25/2026, 23:09:28 UTC

Last enriched: 08/08/2026, 16:58:21 UTC

Last updated: 09/07/2026, 10:52:10 UTC

Views: 58

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses