Executive brief
FFmpeg, a widely used multimedia framework for processing audio and video, contains a vulnerability in its MACE6 audio decoder. By tricking a user into opening a specially crafted CAF audio file, an attacker could cause the application to crash or potentially execute malicious code. This could lead to a full system compromise or unauthorized access to sensitive user data.
Technical details
A signed integer overflow vulnerability exists in the mace_decode_frame() function of the MACE6 audio decoder in FFmpeg through version 8.1.2. The flaw is triggered when processing a Core Audio Format (CAF) file containing oversized bytes_per_packet and frames_per_packet values in the 'desc' chunk. This leads to an integer overflow during the computation of the output sample count, resulting in an undersized heap buffer allocation. Subsequent decoding operations then perform an out-of-bounds write to the heap. An attacker can exploit this by providing a malicious CAF file, requiring minimal user interaction (opening the file), to achieve arbitrary code execution. The issue was fixed in commit aafb5c6.
Affected products
- FFmpeg FFmpeg through 8.1.2
Timeline
- 2026-06-29: patched: Fix committed to FFmpeg master branch
- 2026-07-24: disclosed: CVE-2026-66039 published