Executive brief
FFmpeg is a multimedia framework used to encode, decode, and transcode audio and video files. A flaw in how FFmpeg processes MOV video files can cause out-of-bounds memory reads due to insufficiently padded codec configuration data. This could lead to information disclosure or application crashes when processing malformed video files.
Technical details
The vulnerability is an out-of-bounds read in the MOV file format parser, specifically in the mov_read_iacb() function in libavformat/mov.c. The root cause is insufficient padding on extradata (codec configuration buffers) during parsing. The flaw requires processing a specially crafted MOV file, which is a network-reachable attack vector if FFmpeg is exposed via a web service or media processing pipeline. An attacker can trigger a crash or potentially leak memory contents by sending a malformed file. The fix adds proper AV_INPUT_BUFFER_PADDING_SIZE padding to extradata allocations and was merged in FFmpeg 9.0.
Affected products
- FFmpeg FFmpeg before 9.0
Timeline
- 2026-09-13: disclosed
- 2026-05-03: patched: Merged into FFmpeg master branch as part of PR #22988