Quick answers
- Is CVE-2026-64835 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-64835 being exploited in the wild.
- How severe is CVE-2026-64835?
- High severity, with a CVSS score of 8.8, published 22 July 2026.
- Which products and versions are affected?
- Ffmpeg 4.4 through 8.1.2.
- Is there a fix for CVE-2026-64835?
- A patch was published on 2026-07-02: Pull request merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-64835 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-64835?
- Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds (OOB) memory access vulnerability exists in the FFmpeg ADX audio decoder (libavcodec/adxdec.c). The root cause is a failure to update the internal channel state in the adx_decode_frame function when AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream. While the function re-parses the stream header, it retains a stale channel count, leading subsequent decoding operations to access the prev[] state array out of bounds. An attacker can exploit this by providing a crafted ADX or AAX file with a mid-stream channel layout change, potentially achieving remote code execution or a denial-of-service. A fix has been committed to the FFmpeg master branch.
Affected products
- FFmpeg FFmpeg 4.4 through 8.1.2
Timeline
- 2026-06-29: other: Fix committed to FFmpeg source code
- 2026-07-02: patched: Pull request merged into master branch
- 2026-07-22: advisory: NVD and VulnCheck published advisory details