CVE-2026-66036 FFmpeg CVE debrief

Who should care

Users of FFmpeg, particularly those who process video files with the vf_hqdn3d filter, should be aware of this vulnerability and take steps to mitigate it. Affected operators include users of FFmpeg, and affected platforms include systems that process video files with the vf_hqdn3d filter. Vulnerability-management and security teams should review the official advisory and CVE record for more information.

Technical summary

The vf_hqdn3d filter in FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability. This vulnerability allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.

Defensive priority

High

Recommended defensive actions

• Update FFmpeg to version 8.1.2 or later
• Disable filtergraph reinitialization via the -reinit_filter 0 option
• Use a compensating control, such as input validation and sanitization
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-24T20:18:20.433Z and has been modified since then. The NVD entry is currently Awaiting Analysis. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the official CVE record and NVD entry. The vulnerability was fixed in commit 5d7112c. Users should review the official advisory and CVE record for more information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.