CVE-2026-66036Patch(ffmpeg / ffmpeg)

🔴 FFmpeg'te 6 yeni önemli güvenlik açığı (CVE-2026-66036, CVE-2026-66037, CVE-2026-66038, CVE-2026-66039, CVE-2026-66040 ve CVE-2026-66041) keşfedildi. Açıklar; kötü amaçlı hazırlanmış video, ses, altyazı ve PNG dosyaları aracılığıyla bellek bozulmasına, hizmet reddine (DoS), bilgi sızıntısına ve bazı senaryolarda uzaktan kod çalıştırmaya (RCE) yol açabiliyor. FFmpeg 8.1.2 ve daha eski sürümler risk altında. FFmpeg'i yamalı sürüme, FFmpeg kullanan uygulamalarınızı ise en güncel sürüme yükseltin.

FFmpeg Security Advisory: Multiple high-severity vulnerabilities (CVSS up to 7.7) have been disclosed and patched upstream — organizations should update immediately and avoid processing untrusted media with risky filter configurations. 🔵 CVE-2026-66036 – Heap corruption via vf_hqdn3d filter 🔵 CVE-2026-66041 – Buffer overflow via vf_quirc/subtitle parsing 🔵 CVE-2026-66039 – Integer/heap overflow in MACE6 audio decoder 🔵 CVE-2026-66040 – Heap corruption in PNG/APNG encoder 🔵 CVE-2026-66037 – Memory exhaustion via IAMF demuxer 🔵 CVE-2026-66038 – Uninitialized memory disclosure in LCL/ZLIB decoder Recommended Action: Update FFmpeg to a version incorporating the upstream fixes (commits 5d7112c, 8670835, e7cbfd1, aafb5c6, b506faf, 4da9812).

🚨*CVE* CVE-2026-66036 FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory … https://www.cve.org/CVERecord?id=CVE-2026-66036 ----- Traducción: CVE-2026-66036 FFm… http://infoflow.cloud`

CVE-2026-66036 FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory … https://www.cve.org/CVERecord?id=CVE-2026-66036

🚨High - FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter (CVE-2026-66036) FFmpeg (through 8.1.2) has a heap out-of-bounds write in its hqdn3d denoise filter. When filtergraph reinitialization is disabled with -reinit_filter 0, vf_hqdn3d.config_input() sizes per-plane line-history buffers from the initial frame width; a later, larger-resolution frame then makes denoise_spatial() write past the allocation, corrupting the heap. An attacker supplies a crafted video whose resolution increases between frames. Exploitation requires the hqdn3d filter plus the non-default -reinit_filter 0 option on untrusted input, so exposure is narrower than a default-path bug - but heap corruption from attacker media is serious where that config is used. CVSS 7.7. 👉Update FFmpeg to the release containing fix commit 5d7112c (PR #23783).