CVE-2026-65706 FFmpeg CVE debrief

Who should care

Developers and administrators using FFmpeg versions 3.0 through 8.1.2 should be aware of this high-severity vulnerability and take steps to mitigate it. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to ensure proper mitigation. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified.

Technical summary

CVE-2026-65706 is an out-of-bounds write vulnerability in the vf_swaprect video filter of FFmpeg. The vulnerability allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. This occurs because the filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.

Defensive priority

High priority should be given to updating FFmpeg to a version that patches this vulnerability, as it has the potential for code execution.

Recommended defensive actions

• Update FFmpeg to a version that patches this vulnerability
• Implement compensating controls to detect and prevent exploitation
• Monitor for suspicious activity related to FFmpeg
• Perform inventory checks to identify affected systems
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on this vulnerability, but further analysis is needed to fully understand the impact and potential mitigations. Affected systems may be vulnerable to code execution if they process crafted NV12 video frames. Defenders should verify that their systems are updated to a patched version of FFmpeg and monitor for suspicious activity related to FFmpeg. The vulnerability has a high CVSS score of 8.5, indicating a high severity. Additional review of the official advisory and CVE record is recommended to validate affected scope, severity, and vendor guidance.

Official resources