Heap Corruption in FFmpeg via TY Demuxer

Executive Summary

CVE-2026-65704 is an out-of-bounds write vulnerability in FFmpeg versions 8.1.2 and earlier. It occurs in the TY demuxer and Shorten decoder components. Attackers exploit it by providing a specially crafted ffconcat file processed with the -safe 0 flag. The demux_audio() function in the TY demuxer decrements packet size without bounds checking, creating a negative value. This negative value is passed to memcpy() in shorten_decode_frame(), where it wraps to near SIZE_MAX during conversion to size_t. This causes the function to read beyond allocated memory and write far beyond the Shorten decoder's buffer, leading to heap corruption.

The vulnerability allows attackers to cause memory corruption, potentially enabling arbitrary code execution or denial-of-service conditions on affected systems.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect FFmpeg versions for 8.1.2 or earlier. Check for suspicious ffconcat file processing with the -safe 0 flag. Monitor for heap corruption errors or crashes in FFmpeg operations involving TY demuxer or Shorten decoder.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you if you use FFmpeg 8.1.2 or earlier to process untrusted ffconcat files with the -safe 0 flag. An attacker could exploit this to corrupt memory on your system, potentially leading to crashes, arbitrary code execution, or unauthorized access. Systems processing media files from untrusted sources are particularly at risk.

Useful 0 Not Useful 0

Mitigation Strategies

Update FFmpeg to the latest patched version immediately. Avoid using the -safe 0 flag with untrusted ffconcat files. Restrict access to FFmpeg operations and monitor for anomalous memory usage or crashes.

Useful 0 Not Useful 0