CVE-2026-66037
Last modified
CVE-2026-66037 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ffmpeg | Ffmpeg | <= 8.1.2 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-66037?
How severe is CVE-2026-66037?
How do I fix CVE-2026-66037?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-66031Ekushey Project Manager CRM through version 5.0 contains a s…5.4
- CVE-2026-66032libssh2 through 1.11.1, fixed in commit 5e47761, contains a …8.8
- CVE-2026-66033libssh2 through 1.11.1, fixed in commit a2ed82d, contains a …8.7
- CVE-2026-66034libssh2 through 1.11.1, fixed in commit a13bb6c, contains a …7.7
- CVE-2026-66035libssh2 through 1.11.1, fixed in commit 42e33d8, contains a …7.7
- CVE-2026-66036FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a he…8.8
- CVE-2026-66038FFmpeg through 8.1.2, fixed in commit 8670835, contains an i…6.5
- CVE-2026-66039FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a si…7.8
- CVE-2026-6604A vulnerability was identified in modelscope agentscope up t…7.3
- CVE-2026-66040FFmpeg through 8.1.2, fixed in commit b506faf, contains a he…8.8
- CVE-2026-66041FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains …7.8
- CVE-2026-6605A security flaw has been discovered in modelscope agentscope…7.3
Are you affected by CVE-2026-66037?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST