Executive brief
FFmpeg, a widely used multimedia framework for processing audio and video, contains a flaw in its ADX audio decoder. By tricking a user into opening a specially crafted audio file, an attacker could cause the application to crash or potentially execute unauthorized code. This could lead to a total compromise of the system running the affected software or the theft of sensitive user data.
Technical details
An out-of-bounds (OOB) memory access vulnerability exists in the FFmpeg ADX audio decoder (libavcodec/adxdec.c). The root cause is a failure to update the internal channel state in the adx_decode_frame function when AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream. While the function re-parses the stream header, it retains a stale channel count, leading subsequent decoding operations to access the prev[] state array out of bounds. An attacker can exploit this by providing a crafted ADX or AAX file with a mid-stream channel layout change, potentially achieving remote code execution or a denial-of-service. A fix has been committed to the FFmpeg master branch.
Affected products
- FFmpeg FFmpeg 4.4 through 8.1.2
Timeline
- 2026-06-29: other: Fix committed to FFmpeg source code
- 2026-07-02: patched: Pull request merged into master branch
- 2026-07-22: advisory: NVD and VulnCheck published advisory details