# CVE-2026-66041: FFmpeg heap out-of-bounds write in vf_quirc filter

Source: https://junglewise.ai/threats/cve-2026-66041-ffmpeg-heap-out-of-bounds-write-in-vf-quirc-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-66041 · Severity: high · CVSS 8.8 · Published 2026-07-24

FFmpeg, a widely used multimedia framework for processing video and audio, contains a flaw in its QR code detection filter. An attacker can exploit this by providing a specially crafted subtitle file that causes the software to crash or potentially execute unauthorized code. This could lead to service disruptions or the compromise of systems processing untrusted media files.

Technologies: [Ffmpeg](https://junglewise.ai/threats/technologies/ffmpeg). Vendors: [Ffmpeg](https://junglewise.ai/threats/vendors/ffmpeg).

## Quick answers

**Is CVE-2026-66041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66041 being exploited in the wild.

**How severe is CVE-2026-66041?** High severity, with a CVSS score of 8.8, published 24 July 2026.

**Which products and versions are affected?** Ffmpeg 7.0 through 8.1.2.

**Is there a fix for CVE-2026-66041?** A patch was published on 2026-06-28: Fix committed to FFmpeg master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66041 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66041?** Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap out-of-bounds write exists in the vf_quirc filter of FFmpeg. The vulnerability is rooted in the filter's failure to resize the libquirc grayscale image buffer when input frame dimensions change mid-stream. An attacker can trigger this by providing a PGS/SUP subtitle file where a subsequent presentation has larger dimensions than the initial one. This causes av_image_copy_plane() to write data beyond the bounds of the initially allocated buffer. The flaw can result in heap corruption, leading to a process crash or potential arbitrary code execution. The issue is fixed in commit 4da9812 by implementing quirc_resize() calls when dimension changes are detected.

## Affected products

- FFmpeg FFmpeg 7.0 through 8.1.2

## Timeline

- 2026-06-28: patched: Fix committed to FFmpeg master branch
- 2026-07-24: advisory: NVD and VulnCheck published advisory details

## References

- [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5](https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5)
- [https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625](https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625)
- [https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter](https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter)

## Related threats

- [FFmpeg heap out-of-bounds read in v4l2_buffers](https://junglewise.ai/threats/cve-2026-125270-ffmpeg-through-9-0-2-contains-a-heap-out-of-bounds-read)
- [FFmpeg double free in H.264 SEI message handling](https://junglewise.ai/threats/cve-2026-125269-ffmpeg-through-9-0-2-contains-a-double-free-vulnerability-in)
- [FFmpeg heap out-of-bounds write in APAC decoder](https://junglewise.ai/threats/cve-2026-125267-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-a-heap-out-of)
- [FFmpeg use-after-free in NVIDIA codec decoding](https://junglewise.ai/threats/cve-2026-125265-ffmpeg-through-9-0-2-contains-a-use-after-free-vulnerability-in)
- [FFmpeg JPEG XL parser uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-125264-ffmpeg-through-9-0-2-contains-an-uncontrolled-resource)