Executive brief
FFmpeg, a widely used multimedia framework for processing video and audio, contains a flaw in its video filtering component. An attacker could exploit this by providing a specially crafted video file with specific dimensions, leading to a program crash or potentially allowing unauthorized code execution. This could impact services that automatically process user-uploaded videos or applications used for media playback.
Technical details
An out-of-bounds write vulnerability exists in the vf_swaprect video filter of FFmpeg due to incorrect buffer size calculation in the config_input() function. The filter_frame() function reuses a temporary row buffer sized only for the first plane's pixel step; when processing NV12 frames with odd widths, the interleaved chroma plane (plane 1) requires a larger buffer than plane 0. Specifically, a 17x16 NV12 frame triggers an 18-byte memcpy into a 17-byte heap allocation. This heap corruption can lead to a process crash or arbitrary code execution. The issue is fixed in the master branch via commit a7e38b617b, which ensures the temporary buffer is sized for the widest plane.
Affected products
- FFmpeg FFmpeg 3.0 through 8.1.2
Timeline
- 2026-07-11: patched: Fix committed to FFmpeg master branch
- 2026-07-23: disclosed: CVE-2026-65706 published