CVE-2026-66037— FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-66037
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()
Source: CVE Program / CVE List V5
Vulnerability Description
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-66037
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66037
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-66037 (2)
Vendor Advisories for CVE-2026-66037 (1)
Same Patch Batch · FFmpeg · 2026-07-24 · 6 CVEs total
| CVE-2026-66036 | 8.8 HIGH | FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter |
| CVE-2026-66040 | 8.8 HIGH | FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder |
| CVE-2026-66041 | 8.8 HIGH | FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter |
| CVE-2026-66039 | 8.8 HIGH | FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File |
| CVE-2026-66038 | 6.5 MEDIUM | FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c |
IV. Related Vulnerabilities
Same product: FFmpeg
- CVE-2026-66041
FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Fil - CVE-2026-66040
FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder - CVE-2026-66039
FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF - CVE-2026-66038
FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcl - CVE-2026-66036
FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter
Same vendor: FFmpeg
- CVE-2026-66041
FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Fil - CVE-2026-66040
FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder - CVE-2026-66039
FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF - CVE-2026-66038
FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcl - CVE-2026-66036
FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter
Same weakness: CWE-770
- CVE-2026-25800
quinn-proto has remote memory exhaustion from unbounded out- - CVE-2026-16756
Allocation of resources without limits in the default aws-sm - CVE-2026-8287
Unrestricted File Upload in BizimHesap Information Systems' - CVE-2026-13069
Queryable Encryption FLE2 Find Payload Missing Input Validat - CVE-2026-13074
Awaitable Hello Command in Exhaust Mode Unthrottled Response
V. Comments for CVE-2026-66037
No comments yet