CVE-2026-65705 FFmpeg CVE debrief

Who should care

Users of FFmpeg versions 3.4 through 8.1.2 should be aware of this high-severity vulnerability and take steps to mitigate it. This includes inventorying FFmpeg installations, verifying versions are within the affected range, and applying vendor patches or updates to FFmpeg installations. Additionally, implementing compensating controls such as monitoring for suspicious activity and considering disabling the vf_floodfill video filter if not in use can help reduce the risk of exploitation.

Technical summary

CVE-2026-65705 is an out-of-bounds write vulnerability in the vf_floodfill video filter of FFmpeg. The vulnerability allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.

Defensive priority

High

Recommended defensive actions

• Inventory FFmpeg installations and verify versions are within the affected range.
• Apply vendor patches or updates to FFmpeg installations.
• Implement compensating controls such as monitoring for suspicious activity.
• Consider disabling the vf_floodfill video filter if not in use.
• Review and verify affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, further analysis is needed to fully understand the impact and potential mitigations. Affected product deployments should be identified and verified for exposure. The vulnerability allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening. Defenders should verify FFmpeg installations and apply vendor patches or updates to mitigate the vulnerability.

Official resources