CVE-2026-65704 Details
Description
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.
A heap corruption vulnerability due to an out-of-bounds write has been identified in FFmpeg versions through 8.1.2. This issue arises in the TY demuxer's demux_audio() function, which improperly decrements the packet size without adequate bounds checking. As a result, a negative size value is generated and passed to memcpy() in the shorten_decode_frame() function. This mismanagement of packet size causes reads beyond the allocated source memory and writes far past the Shorten decoder's bitstream buffer. The vulnerability can be exploited by supplying a crafted ffconcat file processed with the -safe 0 flag.
Users can upgrade to FFmpeg 9.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ffmpeg ffmpeg | <= 8.1.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | Initial Analysis | [email protected] |
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |