CVE-2026-65705 - FFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()

Back Back to CVE browser

HIGH

FFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()

Published Jul 23, 2026

7.3

HIGH

CVSS 4.0

EPSS 0.19%

Description

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.

Affected products

Vendor FFmpeg Product FFmpeg Default
affected
- Version
  3.4
  Status
  affected
  Constraints
  <=8.1.2
Vendor FFmpeg Product FFmpeg Default
affected
- Version
  
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FFmpeg

affected

Version	Status	Constraints
3.4	affected	<=8.1.2

FFmpeg

affected

Version	Status	Constraints
	unaffected	-

Red Hat Enterprise Linux AI (RHEL AI) 3

ffmpeg

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-aws-cuda-rhel9

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-azure-cuda-rhel9

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-azure-rocm-rhel9

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-cuda-rhel9

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-gcp-cuda-rhel9

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-rocm-rhel9

Fix deferred
Red Hat OpenShift AI (RHOAI)

rhoai/odh-vllm-gaudi-rhel9

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux AI (RHEL AI) 3	ffmpeg	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-aws-cuda-rhel9	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-azure-cuda-rhel9	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-azure-rocm-rhel9	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-cuda-rhel9	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-gcp-cuda-rhel9	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-rocm-rhel9	Fix deferred	n/a
Red Hat OpenShift AI (RHOAI)	rhoai/odh-vllm-gaudi-rhel9	Fix deferred	n/a

Remediation

Red Hat statement

Red Hat Enterprise Linux has multiple layers of heap protection. NX/DEP (Non-Executable Memory) prevents code execution from heap, thus mitigating the code execution part of the exploit.

Weaknesses (2)

CWE-131

CWE-787

Out-of-bounds Write

References (7)

https://access.redhat.com/security/cve/CVE-2026-65705
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2506591
Issue Tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c
patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780
issue-trackingIssue TrackingPatch
https://nvd.nist.gov/vuln/detail/CVE-2026-65705
https://www.cve.org/CVERecord?id=CVE-2026-65705
https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-65705		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2506591		Issue Tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c		patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780		issue-trackingIssue TrackingPatch
https://nvd.nist.gov/vuln/detail/CVE-2026-65705
https://www.cve.org/CVERecord?id=CVE-2026-65705
https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame		third-party-advisoryThird Party Advisory