VulnSocial

CVE-2026-66039Disclosure(ffmpeg / ffmpeg)

LOWCVSS 7.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch ffmpeg ffmpeg systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.

ffmpeg CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-122CWE-190

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ffmpeg

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-24); latest day: 2
  • 4 total mentions across 2 days

Affected systems

Vendors
ffmpeg
Products
ffmpeg

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-07-24: 2Mentions · 2026-07-28: 2Patch / Workaround · 2026-07-24: 2Patch / Workaround · 2026-07-28: 2Technical Details · 2026-07-24: 2Technical Details · 2026-07-28: 207-2407-28
Signal classification2 categories
Disclosure
250.0%
Patch
250.0%
Referenced assets2 URLs
By indicator
Full discourse4 posts
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🔴 FFmpeg'te 6 yeni önemli güvenlik açığı (CVE-2026-66036, CVE-2026-66037, CVE-2026-66038, CVE-2026-66039, CVE-2026-66040 ve CVE-2026-66041) keşfedildi. Açıklar; kötü amaçlı hazırlanmış video, ses, altyazı ve PNG dosyaları aracılığıyla bellek bozulmasına, hizmet reddine (DoS), bilgi sızıntısına ve bazı senaryolarda uzaktan kod çalıştırmaya (RCE) yol açabiliyor. FFmpeg 8.1.2 ve daha eski sürümler risk altında. FFmpeg'i yamalı sürüme, FFmpeg kullanan uygulamalarınızı ise en güncel sürüme yükseltin.

    Post summary

    Six critical FFmpeg CVEs causing memory corruption, DoS, information disclosure and potential RCE were discovered; users are urged to patch or upgrade to the latest version.

    00001152
    1.3K followersView on X
  • TECHEPAGES@techepages
    Patch

    FFmpeg Security Advisory: Multiple high-severity vulnerabilities (CVSS up to 7.7) have been disclosed and patched upstream — organizations should update immediately and avoid processing untrusted media with risky filter configurations. 🔵 CVE-2026-66036 – Heap corruption via vf_hqdn3d filter 🔵 CVE-2026-66041 – Buffer overflow via vf_quirc/subtitle parsing 🔵 CVE-2026-66039 – Integer/heap overflow in MACE6 audio decoder 🔵 CVE-2026-66040 – Heap corruption in PNG/APNG encoder 🔵 CVE-2026-66037 – Memory exhaustion via IAMF demuxer 🔵 CVE-2026-66038 – Uninitialized memory disclosure in LCL/ZLIB decoder Recommended Action: Update FFmpeg to a version incorporating the upstream fixes (commits 5d7112c, 8670835, e7cbfd1, aafb5c6, b506faf, 4da9812).

    Post summary

    The advisory discloses multiple high‑severity FFmpeg vulnerabilities and urges immediate patching, providing specific commit hashes that contain the fixes.

    0000034
    35 followersView on X
  • Infoflowcloud@infoflowcloud
    Patch

    🚨*CVE* CVE-2026-66039 FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memor… https://www.cve.org/CVERecord?id=CVE-2026-66039 ----- Traducción: CVE-2026-66039 FFm… http://infoflow.cloud`

    Post summary

    The tweet announces a signed integer overflow in FFmpeg’s MACE6 audio decoder, notes it was fixed in a recent commit, and provides technical details without referencing active exploitation or a PoC.

    0000039
    94 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-66039 FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memor… https://www.cve.org/CVERecord?id=CVE-2026-66039

    Post summary

    The tweet notes the CVE‑2026‑66039 signed integer overflow flaw in FFmpeg’s MACE6 audio decoder and says it is fixed in commit aafb5c6.

    000001.1K
    57.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appffmpegffmpeg---

Explore more

Back to dashboardffmpeg CVEsffmpeg vulnerabilities