CVE-2026-66041 - FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter

Back Back to CVE browser

HIGH

FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter

Published Jul 24, 2026

7.7

HIGH

CVSS 4.0

EPSS 0.49%

Description

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Affected products

Vendor FFmpeg Product FFmpeg Default
affected
- Version
  7.0
  Status
  affected
  Constraints
  <=8.1.2
Vendor FFmpeg Product FFmpeg Default
affected
- Version
  
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FFmpeg

affected

Version	Status	Constraints
7.0	affected	<=8.1.2

FFmpeg

affected

Version	Status	Constraints
	unaffected	-

Red Hat Enterprise Linux AI (RHEL AI) 3

ffmpeg

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-aws-cuda-rhel9

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-azure-cuda-rhel9

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-azure-rocm-rhel9

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-cuda-rhel9

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-gcp-cuda-rhel9

Affected
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-rocm-rhel9

Affected
Red Hat OpenShift AI (RHOAI)

rhoai/odh-vllm-gaudi-rhel9

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux AI (RHEL AI) 3	ffmpeg	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-aws-cuda-rhel9	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-azure-cuda-rhel9	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-azure-rocm-rhel9	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-cuda-rhel9	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-gcp-cuda-rhel9	Affected	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-rocm-rhel9	Affected	n/a
Red Hat OpenShift AI (RHOAI)	rhoai/odh-vllm-gaudi-rhel9	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (8)

https://access.redhat.com/security/cve/CVE-2026-66041
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2506935
Issue Tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5
patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625
issue-trackingExploitPatch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-48743
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-66041
https://www.cve.org/CVERecord?id=CVE-2026-66041
https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-66041		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2506935		Issue Tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5		patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625		issue-trackingExploitPatch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-48743		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-66041
https://www.cve.org/CVERecord?id=CVE-2026-66041
https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter		third-party-advisoryThird Party Advisory