CVE-2026-66039 Details

A signed integer overflow vulnerability has been identified in the MACE6 audio decoder of FFmpeg versions through 8.1.2. This vulnerability allows attackers to corrupt heap memory by crafting a CAF file with a malicious bytes_per_packet value. The exploitation involves using oversized bytes_per_packet and frames_per_packet values in the desc chunk, which triggers an integer overflow in the 'mace_decode_frame()' function during the computation of output sample counts. This overflow leads to an undersized buffer allocation and a heap out-of-bounds write, potentially enabling code execution.

Users can upgrade to FFmpeg version 9.0 or later to address this vulnerability.