Executive brief
FFmpeg is a widely-used multimedia library that encodes and decodes audio and video formats. A missing memory buffer boundary check in the WMA audio encoder allows an attacker to read beyond allocated memory, potentially exposing sensitive data or causing a crash during audio file processing.
Technical details
An out-of-bounds read vulnerability exists in libavcodec/wmaenc.c due to insufficient padding in WMA extradata allocation. The vulnerable code fails to allocate the required AV_INPUT_BUFFER_PADDING_SIZE additional bytes when creating the extradata buffer, violating FFmpeg's internal memory layout expectations. An attacker can trigger the out-of-bounds read by providing a crafted WMA audio stream, though exploitation typically requires local access or direct processing of malicious media. The vulnerability was patched in FFmpeg 9.0 (merge on 2026-05-03) by adding proper padding to extradata allocations in multiple codec paths including WMA, FLAC, and IAMF handlers.
Affected products
- FFmpeg FFmpeg before 9.0
Timeline
- 2026-05-01: disclosed: Vulnerability reported by Kenan Alghythee
- 2026-05-03: patched: Fix merged into master branch for FFmpeg 9.0
- 2026-09-13: advisory: CVE-2026-52296 published