Every CVE Search/ Get API key

CVE-2026-66041

FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter

7.7 HighFix available

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.49%Up 0.1 points since Jul 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.7

FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Record
CVE-2026-66041
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-48743 7.7

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Record
EUVD-2026-48743
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-frhp-m687-9g3q 7.7

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Record
GHSA-frhp-m687-9g3q
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 7.7

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Record
CVE-2026-66041
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 7.7

FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Record
CVE-2026-66041
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-66041 7.8

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Record
DEBIAN-CVE-2026-66041
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVJLSEC-2026-1187 7.7

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Record
JLSEC-2026-1187
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-66041 7.7

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

Record
UBUNTU-CVE-2026-66041
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2026-0398 No score

Updated ffmpeg package fixes security vulnerabilities

Out-of-Bounds Write in RASC Decoder decode_dlta(). (CVE-2026-58049) Heap Buffer Overflow via VobSub Subtitle Demuxer. (CVE-2026-64830) Double-Free in NVDEC Hardware Decoder via nvdec.c. (CVE-2026-64832) Out-of-Bounds Read via S/PDIF Muxer spdifenc.c. (CVE-2026-64833) Infinite Loop DoS via RTP/ASF Demuxer. (CVE-2026-64834) Out-of-Bounds Memory Access in ADX Audio Decoder. (CVE-2026-64835) Out-of-Bounds Write in TDSC Video Decoder. (CVE-2026-65703) Out-of-Bounds Write via TY Demuxer and Shorten Decoder. (CVE-2026-65704) vf_floodfill Out-of-Bounds Write via filter_frame(). (CVE-2026-65705) vf_swaprect Out-of-Bounds Write via NV12 Frame Processing. (CVE-2026-65706) Heap Out-of-Bounds Write in vf_hqdn3d Filter. (CVE-2026-66036) IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu(). (CVE-2026-66037) LCL/ZLIB Video Decoder Information Disclosure via lcldec.c. (CVE-2026-66038) MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File. (CVE-2026-66039) Heap Out-of-Bounds Write via vf_quirc Filter. (CVE-2026-66041) DVB Subtitle Parser Heap Buffer Overflow via WTV File. (CVE-2026-70628) Uninitialized Heap Memory Read in RSCC Decoder. (CVE-2026-70629) Uninitialized Heap Memory Read in Screenpresso Decoder. (CVE-2026-70630) Uninitialized Heap Memory Read in TIFF Decoder. (CVE-2026-70631) Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing. (CVE-2026-70632) Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing. (CVE-2026-75141) Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c. (CVE-2026-75142) Heap Buffer Overflow via RIST Protocol Reader. (CVE-2026-75143) Heap Buffer Overflow in VC-2/Dirac RTP Packetizer. (CVE-2026-75144) Out-of-Bounds Read in DASH Demuxer via dashdec.c. (CVE-2026-75146)

Record
MGASA-2026-0398
Updated
2026-11-02
OSVopenSUSE-SU-2026:11665-1 No score

ffmpeg-7-7.1.5-2.1 on GA media

These are all security issues fixed in the ffmpeg-7-7.1.5-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11665-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21572-1 No score

Security update for ffmpeg-7

This update for ffmpeg-7 fixes the following issues:

  • CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).
  • CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754).
  • CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758).
  • CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768).
  • CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).
  • CVE-2026-66041: Heap Out-of-Bounds Write via vf_quirc Filter (bsc#1272767).
Record
openSUSE-SU-2026:21572-1
Updated
2026-11-02
OSVSUSE-SU-2026:23222-1 No score

Security update for ffmpeg-7

This update for ffmpeg-7 fixes the following issues:

  • CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).
  • CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754).
  • CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758).
  • CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768).
  • CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).
  • CVE-2026-66041: Heap Out-of-Bounds Write via vf_quirc Filter (bsc#1272767).
Record
SUSE-SU-2026:23222-1
Updated
2026-11-02
OSVSUSE-SU-2026:23232-1 No score

Security update for ffmpeg-7

This update for ffmpeg-7 fixes the following issues:

  • CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).
  • CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754).
  • CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758).
  • CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768).
  • CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).
  • CVE-2026-66041: Heap Out-of-Bounds Write via vf_quirc Filter (bsc#1272767).
Record
SUSE-SU-2026:23232-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ffmpeg
Debian:13
 All versions, plus listed versions
7:7.1.1-17:7.1.2-0+deb13u17:7.1.2-17:7.1.3-0+deb13u17:7.1.3-1
Show 22 moreShow less
7:7.1.4-0+deb13u17:7.1.5-0+deb13u17:8.0-17:8.0-27:8.0.1-17:8.0.1-27:8.0.1-37:8.1-17:8.1-27:8.1-37:8.1.1-17:8.1.1-27:8.1.1-37:8.1.1-47:8.1.2-17:8.1.2-27:9.0-17:9.0.1-17:9.0.2-17:9.0.2-27:9.0.2-37:9.0.2-4
 None known
ffmpeg
Debian:14
 before 7:9.0.2-1, plus listed versions
7:7.1.1-17:7.1.2-17:7.1.3-17:8.0-17:8.0-2
Show 14 moreShow less
7:8.0.1-17:8.0.1-27:8.0.1-37:8.1-17:8.1-27:8.1-37:8.1.1-17:8.1.1-27:8.1.1-37:8.1.1-47:8.1.2-17:8.1.2-27:9.0-17:9.0.1-1
7:9.0.2-1
FFMPEG_jll
Julia
 7.1.0+0 up to 9.0.0+0
9.0.0+0
FFMPEG_nogpl_jll
Julia
 before 9.0.0+0
9.0.0+0
FFplay_jll
Julia
 7.1.0+0 up to 9.0.0+0
9.0.0+0
ffmpeg
Mageia:10
 before 7.1.5-1.1.mga10
7.1.5-1.1.mga10
ffmpeg
Mageia:10
 before 7.1.5-1.1.mga10.tainted
7.1.5-1.1.mga10.tainted
ffmpeg-7
SUSE:Linux Enterprise Server 16.0
 before 7.1.4-160000.3.1
7.1.4-160000.3.1
ffmpeg-7
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 7.1.4-160000.3.1
7.1.4-160000.3.1
ffmpeg
Ubuntu:26.10
 All versions, plus listed versions
7:8.0.1-3ubuntu27:8.1-3ubuntu37:8.1.2-2ubuntu2
 None known
ffmpeg
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
7:7.1.1-1ubuntu47:7.1.2-1ubuntu37:7.1.2-1ubuntu47:7.1.3-1ubuntu17:8.0.1-2ubuntu1
Show 6 moreShow less
7:8.0.1-3ubuntu17:8.0.1-3ubuntu27:8.0.1-3ubuntu2+esm17:8.0.1-3ubuntu2+esm37:8.0.1-3ubuntu2+esm47:8.0.1-3ubuntu2+esm5
 None known
ffmpeg-7
openSUSE:Tumbleweed
 before 7.1.5-2.1
7.1.5-2.1
ffmpeg-7
openSUSE:Leap 16.0
 before 7.1.4-160000.3.1
7.1.4-160000.3.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-66041 is a high vulnerability (CVSS 7.7) in Ffmpeg, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in ffmpeg 7:9.0.2-1.

References

Show 44 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open