Executive brief
FFmpeg, a widely used multimedia framework for processing video and audio, contains a flaw in its QR code detection filter. An attacker can exploit this by providing a specially crafted subtitle file that causes the software to crash or potentially execute unauthorized code. This could lead to service disruptions or the compromise of systems processing untrusted media files.
Technical details
A heap out-of-bounds write exists in the vf_quirc filter of FFmpeg. The vulnerability is rooted in the filter's failure to resize the libquirc grayscale image buffer when input frame dimensions change mid-stream. An attacker can trigger this by providing a PGS/SUP subtitle file where a subsequent presentation has larger dimensions than the initial one. This causes av_image_copy_plane() to write data beyond the bounds of the initially allocated buffer. The flaw can result in heap corruption, leading to a process crash or potential arbitrary code execution. The issue is fixed in commit 4da9812 by implementing quirc_resize() calls when dimension changes are detected.
Affected products
- FFmpeg FFmpeg 7.0 through 8.1.2
Timeline
- 2026-06-28: patched: Fix committed to FFmpeg master branch
- 2026-07-24: advisory: NVD and VulnCheck published advisory details