CVE-2026-66041
Received Received - Intake

Heap Out-of-Bounds Write in FFmpeg vf_quirc Filter

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-25
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-66041
EUVD
EUVD-2026-48743

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ffmpeg ffmpeg From 7.0 (inc) to 8.1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66041 is a heap out-of-bounds write vulnerability in FFmpeg versions 7.0 through 8.1.2. It occurs in the vf_quirc filter when processing PGS/SUP subtitle files with mismatched frame dimensions. If the second subtitle frame is larger than the first, it causes av_image_copy_plane() to write data beyond the allocated buffer in libquirc, leading to heap corruption.

Detection Guidance

Detecting this vulnerability requires analyzing FFmpeg versions and subtitle file processing. Check FFmpeg version with 'ffmpeg -version' and inspect subtitle files for mismatched frame dimensions. Monitor for crashes during subtitle processing, especially with PGS/SUP files.

Impact Analysis

This vulnerability could allow an attacker to crash the FFmpeg process or execute arbitrary code by providing a specially crafted subtitle file. Users processing untrusted subtitle files with vulnerable FFmpeg versions are at risk of system compromise or denial of service.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling arbitrary code execution through crafted subtitle files. If exploited, it may lead to unauthorized data access, modification, or disclosure, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately upgrade FFmpeg to a version beyond 8.1.2. Avoid processing untrusted subtitle files, particularly PGS/SUP formats. Implement input validation for subtitle dimensions. Monitor systems for unusual crashes or memory corruption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66041. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart