Libav: FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows… (CVE-2026-66040)
Affects libavSource GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 55% of CVEs
- Patch
- Available – fixed in 8.1.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHub Actionsffmpeg/FFmpegpkg:github/ffmpeg/FFmpegOther threats | Affected
| Fixed in
|
Ubuntu:Pro:14.04:LTSlibavpkg:deb/ubuntu/libav?arch=source&distro=esm-infra-legacy/trustyOther threats | Affected
| Fixed in– |
Ubuntu:26.10ffmpegpkg:deb/ubuntu/ffmpeg?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix for this vulnerability is available in the commit identified as b506faf. Users and administrators should update FFmpeg to a version later than 8.1.2 that includes this fix. Since this is not a cloud service, manual patching or upgrading is required.
Description
FFmpeg versions up to 8.1.2 contain a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. This vulnerability allows remote attackers to corrupt heap memory by crafting a malicious PNG image with a specially crafted eXIf chunk. The flaw can cause heap corruption, process crashes, and potentially arbitrary code execution. The issue is fixed in commit b506faf.
Summary
CVE-2026-66040 is a heap out-of-bounds write vulnerability affecting FFmpeg's native PNG and APNG encoders in versions up to 8.1.2. The vulnerability arises from improper handling of the eXIf chunk in PNG images, enabling remote attackers to corrupt heap memory. This can lead to heap corruption, application crashes, and may allow execution of arbitrary code. The vulnerability is addressed by a fix committed in b506faf.
Impact
Successful exploitation of this vulnerability can lead to heap memory corruption, causing process crashes and potentially allowing remote attackers to execute arbitrary code on affected systems. This poses a significant risk to systems processing malicious PNG images using vulnerable FFmpeg versions.
Weaknesses
References
- nvd.nist.gov/vuln/detail/CVE-2026-66040 (opens in a new tab)
- code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc (opens in a new tab)
- code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786 (opens in a new tab)
- vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder (opens in a new tab)
- ubuntu.com/security/CVE-2026-66040 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-66040 (opens in a new tab)
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.