CVE-2026-66040 - FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder

Back Back to CVE browser

HIGH

FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder

Published Jul 24, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.78%

Description

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.

Affected products

Vendor FFmpeg Product FFmpeg Default
affected
- Version
  0
  Status
  affected
  Constraints
  <=8.1.2
Vendor FFmpeg Product FFmpeg Default
affected
- Version
  
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FFmpeg

affected

Version	Status	Constraints
0	affected	<=8.1.2

FFmpeg

affected

Version	Status	Constraints
	unaffected	-

Red Hat Enterprise Linux AI (RHEL AI) 3

ffmpeg

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-aws-cuda-rhel9

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-azure-cuda-rhel9

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-azure-rocm-rhel9

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-cuda-rhel9

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-gcp-cuda-rhel9

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-rocm-rhel9

Affected
Red Hat OpenShift AI (RHOAI)

rhoai/odh-vllm-gaudi-rhel9

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux AI (RHEL AI) 3	ffmpeg	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-aws-cuda-rhel9	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-azure-cuda-rhel9	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-azure-rocm-rhel9	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-cuda-rhel9	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-gcp-cuda-rhel9	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-rocm-rhel9	Affected	n/a
Red Hat OpenShift AI (RHOAI)	rhoai/odh-vllm-gaudi-rhel9	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-122

CWE-787

Out-of-bounds Write

References (8)

https://access.redhat.com/security/cve/CVE-2026-66040
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2506936
Issue Tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc
patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786
issue-trackingIssue TrackingPatch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-48742
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-66040
https://www.cve.org/CVERecord?id=CVE-2026-66040
https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-66040		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2506936		Issue Tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc		patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786		issue-trackingIssue TrackingPatch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-48742		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-66040
https://www.cve.org/CVERecord?id=CVE-2026-66040
https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder		third-party-advisoryThird Party Advisory