The IAMF demuxer in FFmpeg versions up to 8.1.2 has a vulnerability where the mix_presentation_obu() function calls av_calloc() with an attacker-controlled count_label value before validating the available OBU data. This allows an attacker to cause an allocation amplification of approximately 126 million bytes per input byte, resulting in multi-gigabyte memory allocation from a 17-byte crafted input file. This uncontrolled resource consumption can exhaust process memory or trigger an out-of-memory kill during format probing. The issue is tracked as CVE-2026-66037 and is fixed in commit 5d7112c.

An unauthenticated attacker can cause a denial of service by exhausting system memory or causing the FFmpeg process to be terminated due to out-of-memory conditions. This impacts availability but does not indicate code execution or data disclosure from the provided information.

A fix is available in FFmpeg as of commit 5d7112c. Users should update to a version including this commit or later to remediate this vulnerability. Patch status is not explicitly confirmed in the provided data, so verify the vendor advisory or official FFmpeg repository for the fixed version. No other mitigations are specified.