Libav: FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows… (CVE-2026-66040)
FFmpeg versions up to 8.1.2 contain a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. This flaw allows remote attackers to corrupt heap memory by crafting a PNG image with a malicious eXIf chunk. The vulnerability can lead to heap corruption, process crashes, and potentially arbitrary code execution. The issue is fixed in a commit identified as b506faf.
AI Analysis
Technical Summary
FFmpeg through version 8.1.2 has a heap out-of-bounds write vulnerability in its native PNG and APNG encoders. The vulnerability arises when processing a crafted PNG image containing a malicious eXIf chunk where multiple IFD entries reference the same large value payload. This causes the canonical serialization to expand output beyond the buffer size estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the allocated buffer boundary. This leads to deterministic heap corruption, which can cause process crashes and potentially allow arbitrary code execution. The vulnerability is tracked as CVE-2026-66040 and is fixed in commit b506faf.
Potential Impact
This vulnerability allows remote attackers to corrupt heap memory by supplying a specially crafted PNG image. The heap corruption can cause application crashes and may enable arbitrary code execution, posing a high risk to confidentiality, integrity, and availability of affected systems.
Mitigation Recommendations
A fix for this vulnerability is available in the commit identified as b506faf. Users should upgrade FFmpeg to a version that includes this fix (versions later than 8.1.2). Since this is not a cloud service, remediation requires applying the patch or upgrading the software. Patch status is confirmed fixed in commit b506faf; users should consult the FFmpeg project for the exact patched release.
Libav: FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows… (CVE-2026-66040)
Description
FFmpeg versions up to 8.1.2 contain a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. This flaw allows remote attackers to corrupt heap memory by crafting a PNG image with a malicious eXIf chunk. The vulnerability can lead to heap corruption, process crashes, and potentially arbitrary code execution. The issue is fixed in a commit identified as b506faf.
CVSS v3.1
Score 8.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FFmpeg through version 8.1.2 has a heap out-of-bounds write vulnerability in its native PNG and APNG encoders. The vulnerability arises when processing a crafted PNG image containing a malicious eXIf chunk where multiple IFD entries reference the same large value payload. This causes the canonical serialization to expand output beyond the buffer size estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the allocated buffer boundary. This leads to deterministic heap corruption, which can cause process crashes and potentially allow arbitrary code execution. The vulnerability is tracked as CVE-2026-66040 and is fixed in commit b506faf.
Potential Impact
This vulnerability allows remote attackers to corrupt heap memory by supplying a specially crafted PNG image. The heap corruption can cause application crashes and may enable arbitrary code execution, posing a high risk to confidentiality, integrity, and availability of affected systems.
Mitigation Recommendations
A fix for this vulnerability is available in the commit identified as b506faf. Users should upgrade FFmpeg to a version that includes this fix (versions later than 8.1.2). Since this is not a cloud service, remediation requires applying the patch or upgrading the software. Patch status is confirmed fixed in commit b506faf; users should consult the FFmpeg project for the exact patched release.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6vcg-882j-82v5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-66040"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a65422a9c2644c7f808a1a1
Added to database: 07/25/2026, 23:09:30 UTC
Last enriched: 08/08/2026, 16:57:55 UTC
Last updated: 09/08/2026, 22:52:14 UTC
Views: 71
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.