Executive brief
FFmpeg is a widely-used multimedia framework that processes audio and video files. The IAMF (Immersive Audio Metadata Format) writer module failed to properly allocate padding when copying codec configuration data, allowing an out-of-bounds read during bitstream parsing. An attacker could exploit this via a maliciously crafted IAMF audio file to trigger a crash or potentially read sensitive memory.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in libavformat/iamf_writer.c where extradata buffers allocated for internal IAMF codec configuration structures lacked the required AV_INPUT_BUFFER_PADDING_SIZE padding bytes. When the FLAC codec configuration was later accessed via GetBitContext-based parsing APIs, the missing padding allowed reads beyond the allocated buffer. The issue affects FFmpeg versions before 9.0. The vulnerable code path is triggered during IAMF file writing when processing codec configuration data. A fix was merged in May 2026 (PR #22988) that properly allocates padded buffers using av_mallocz() with the required padding size.
Affected products
- FFmpeg FFmpeg before 9.0
Timeline
- 2026-09-01: disclosed
- 2026-05-03: patched: Patch merged in PR #22988 to FFmpeg master