Search: CVE-2026-64835

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder. This vulnerability arises from improper handling of internal channel state when processing crafted ADX or AAX audio files with mid-stream channel layout changes, leading to out-of-bounds reads and writes during decoding. The flaw is identified as CVE-2026-64835 and has a CVSS v3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. A patch is available to address this issue.