Executive brief
FFmpeg is a widely used multimedia framework for processing video and audio files. A vulnerability in its 'floodfill' video filter could allow a specially crafted video file to crash the application or potentially execute unauthorized code. This occurs when a video changes dimensions unexpectedly, causing the software to write data outside of its assigned memory area.
Technical details
An out-of-bounds (OOB) write vulnerability exists in the vf_floodfill video filter of FFmpeg. The root cause is an incorrect calculation of buffer size where the points traversal stack is allocated in config_input() based on initial frame dimensions. If filtergraph reinitialization is disabled (e.g., via -reinit_filter 0) and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes that exceed the original heap allocation. This leads to heap corruption, which can result in a process crash or arbitrary code execution. The vulnerability is triggered locally when a user processes a malicious video stream. A fix has been committed to the FFmpeg repository to size the point stack based on the current frame dimensions.
Affected products
- FFmpeg FFmpeg 3.4 through 8.1.2
Timeline
- 2026-07-12: patched: Fix committed to FFmpeg repository
- 2026-07-23: disclosed: CVE-2026-65705 published