FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows… (CVE-2026-66040)
FFmpeg versions through 8.1.2 contain a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. This flaw is triggered by a crafted PNG image with a malicious eXIf chunk that causes excessive memory writes beyond allocated buffers. The vulnerability can lead to deterministic heap corruption, process crashes, and potentially arbitrary code execution. The issue was fixed in a commit identified as b506faf. No explicit affected versions were provided beyond 'through 8.1.2'.
AI Analysis
Technical Summary
A heap out-of-bounds write vulnerability exists in FFmpeg's native PNG and APNG encoders up to version 8.1.2. The vulnerability arises when processing a PNG image containing a malicious eXIf chunk with multiple IFD entries referencing the same large value payload. This causes the canonical serialization process to expand output beyond the buffer size estimated by add_exif_profile_size(), leading png_write_chunk() to write tens of thousands of bytes past the buffer boundary. The resulting heap corruption can cause process crashes and may allow arbitrary code execution. The vulnerability is tracked as CVE-2026-66040 and was fixed in commit b506faf.
Potential Impact
Exploitation of this vulnerability allows remote attackers to cause heap memory corruption by supplying a crafted PNG image. This can lead to deterministic heap corruption and process crashes. Furthermore, the heap corruption may be leveraged to achieve arbitrary code execution, posing a significant security risk.
Mitigation Recommendations
A fix for this vulnerability is available and was implemented in commit b506faf. Users should update FFmpeg to a version that includes this commit to remediate the issue. Patch status is confirmed by the presence of the fix commit. No additional mitigations are indicated.
FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows… (CVE-2026-66040)
Description
FFmpeg versions through 8.1.2 contain a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. This flaw is triggered by a crafted PNG image with a malicious eXIf chunk that causes excessive memory writes beyond allocated buffers. The vulnerability can lead to deterministic heap corruption, process crashes, and potentially arbitrary code execution. The issue was fixed in a commit identified as b506faf. No explicit affected versions were provided beyond 'through 8.1.2'.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A heap out-of-bounds write vulnerability exists in FFmpeg's native PNG and APNG encoders up to version 8.1.2. The vulnerability arises when processing a PNG image containing a malicious eXIf chunk with multiple IFD entries referencing the same large value payload. This causes the canonical serialization process to expand output beyond the buffer size estimated by add_exif_profile_size(), leading png_write_chunk() to write tens of thousands of bytes past the buffer boundary. The resulting heap corruption can cause process crashes and may allow arbitrary code execution. The vulnerability is tracked as CVE-2026-66040 and was fixed in commit b506faf.
Potential Impact
Exploitation of this vulnerability allows remote attackers to cause heap memory corruption by supplying a crafted PNG image. This can lead to deterministic heap corruption and process crashes. Furthermore, the heap corruption may be leveraged to achieve arbitrary code execution, posing a significant security risk.
Mitigation Recommendations
A fix for this vulnerability is available and was implemented in commit b506faf. Users should update FFmpeg to a version that includes this commit to remediate the issue. Patch status is confirmed by the presence of the fix commit. No additional mitigations are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6vcg-882j-82v5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-66040"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a65422a9c2644c7f808a1a1
Added to database: 07/25/2026, 23:09:30 UTC
Last enriched: 07/25/2026, 23:54:52 UTC
Last updated: 07/26/2026, 03:43:32 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.