A signed integer overflow vulnerability exists in FFmpeg's MACE6 audio decoder in versions up to 8.1.2. By supplying a crafted CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk, an attacker can trigger an integer overflow in the mace_decode_frame() function during output sample count computation. This results in an undersized buffer allocation and subsequent heap out-of-bounds write, which could lead to arbitrary code execution. The vulnerability is tracked as CVE-2026-66039 and was fixed in commit aafb5c6.

Successful exploitation allows an attacker to corrupt heap memory via a crafted CAF file, potentially leading to arbitrary code execution within the context of the vulnerable application. This poses a high security risk as it can lead to system compromise.

A fix for this vulnerability is available in the FFmpeg codebase as of commit aafb5c6. Users should update to a version that includes this commit to remediate the issue. Patch status is not explicitly confirmed in the provided data, so users should verify the presence of this fix in their FFmpeg version. No vendor advisory content is provided; therefore, check the official FFmpeg repository or security advisories for the exact patched version and apply updates accordingly.