CVE-2026-66037
Received Received - Intake

Memory Exhaustion in FFmpeg IAMF Demuxer

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-25
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-66037
EUVD
EUVD-2026-48739

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ffmpeg ffmpeg to 8.1.2 (inc)
ffmpeg ffmpeg to 8.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66037 is an uncontrolled resource consumption vulnerability in FFmpeg's IAMF demuxer. An attacker can exploit it by providing a tiny 17-byte file with a manipulated count_label field, causing the system to allocate excessive memory (about 126 million bytes per input byte) before validating the data. This leads to memory exhaustion or system crashes during format probing.

Detection Guidance

To detect this vulnerability, monitor for unusual memory consumption during media file processing. Check FFmpeg versions with 'ffmpeg -version' and look for processes consuming excessive memory during file parsing. Use system monitoring tools like 'top', 'htop', or 'ps' to observe memory usage spikes when processing media files.

Impact Analysis

This vulnerability allows an unauthenticated attacker to crash applications or systems by consuming all available memory with a small malicious file. It can disrupt services, cause denial-of-service conditions, or trigger OOM-kills, potentially leading to downtime or loss of functionality in systems processing media files.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. Memory exhaustion or OOM-kills may cause service disruptions, potentially violating availability requirements in these regulations.

Mitigation Strategies

Immediately update FFmpeg to the latest version or apply the patch from commit 5d7112c. Disable or restrict access to media processing functions if possible. Monitor systems for signs of exploitation and restrict untrusted file uploads or processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66037. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart