CVE-2026-64835: FFmpeg Use-After-Free Vulnerability

CVE-2026-64835 Overview

CVE-2026-64835 is an out-of-bounds memory access vulnerability affecting FFmpeg versions 4.4 through 8.1.2. The flaw resides in the ADX audio decoder within libavcodec/adxdec.c and enables attackers to trigger both out-of-bounds reads and out-of-bounds writes. Exploitation requires a crafted ADX or AAX audio file that performs a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data arrives mid-stream, adx_decode_frame re-parses the stream header without updating the internal channel state. Subsequent decoding operations then access the prev[] state array using a stale channel count, corrupting adjacent memory.

Critical Impact
A crafted ADX or AAX file processed by any application built on FFmpeg can trigger out-of-bounds reads and writes, enabling memory corruption and potential code execution.

Affected Products

FFmpeg 4.4 through 8.1.2
libavcodec ADX audio decoder (adxdec.c)
Downstream applications and media frameworks bundling vulnerable FFmpeg builds

Discovery Timeline

2026-07-22 - CVE-2026-64835 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-64835

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds write [CWE-787] in the ADX audio decoder. FFmpeg's ADX decoder maintains a prev[] state array sized according to the channel count parsed from the initial stream header. When new extradata arrives mid-stream through AV_PKT_DATA_NEW_EXTRADATA side data, the decoder re-parses the header to accommodate format changes. However, adx_decode_frame fails to reallocate or resize the internal channel state to match the newly parsed channel count.

If the new header advertises more channels than the original, subsequent decoding operations iterate beyond the bounds of prev[]. This produces both out-of-bounds reads and writes into adjacent heap memory. Because FFmpeg is embedded across media players, transcoders, browser components, and server-side processing pipelines, the attack surface is broad.

Root Cause

The root cause is missing state synchronization between header parsing and channel-dependent buffer sizing. The decoder trusts the re-parsed header for subsequent sample decoding while continuing to reference stale allocation metadata. Any assumption that channel layout is immutable across a single decode session is violated by mid-stream AV_PKT_DATA_NEW_EXTRADATA transitions.

Attack Vector

An attacker delivers a crafted ADX or AAX file to a victim application that uses vulnerable FFmpeg for decoding. User interaction is required, such as opening the file or navigating to media that triggers decoding. The vulnerability manifests during the mid-stream channel layout change, so the malicious file appears structurally valid on initial parse.

For technical details, see the FFmpeg commit fix, the FFmpeg Pull Request 23659, and the VulnCheck FFmpeg Advisory.

Detection Methods for CVE-2026-64835

Indicators of Compromise

Unexpected crashes, aborts, or heap corruption warnings in processes linking libavcodec when handling ADX or AAX inputs.
ADX or AAX files containing mid-stream AV_PKT_DATA_NEW_EXTRADATA side data that declares a different channel count than the initial header.
AddressSanitizer or heap allocator reports flagging out-of-bounds access in adx_decode_frame or nearby ADX decoder frames.

Detection Strategies

Inventory all applications and containers bundling FFmpeg between versions 4.4 and 8.1.2, including statically linked builds.
Scan media ingestion pipelines for ADX and AAX file types and inspect them for embedded extradata transitions.
Run fuzzing or sanitizer-instrumented builds of libavcodec against untrusted ADX and AAX samples to surface memory violations.

Monitoring Recommendations

Alert on repeated crashes or exit codes from media transcoding workers processing ADX or AAX content.
Log FFmpeg command-line invocations and file types on server-side conversion services to correlate crashes with specific inputs.
Track host process telemetry for anomalous child process spawns from media players immediately after opening audio files.

How to Mitigate CVE-2026-64835

Immediate Actions Required

Upgrade FFmpeg to a patched release beyond 8.1.2 that includes the fix from commit 1836ef96846937a6cc2443698a693104f5c0b21e.
Rebuild and redeploy all internal applications, containers, and packages that statically link vulnerable libavcodec versions.
Restrict ingestion of ADX and AAX files from untrusted sources until the patch is deployed across the environment.

Patch Information

The upstream fix is available in the FFmpeg commit 1836ef96 and merged via Pull Request 23659. The patch updates adx_decode_frame to synchronize the internal channel state when new extradata is processed mid-stream, preventing stale channel counts from indexing the prev[] array.

Workarounds

Disable the ADX demuxer or decoder at build time by configuring FFmpeg with --disable-decoder=adpcm_adx --disable-demuxer=adx where ADX support is not required.
Filter ADX and AAX file types at ingress on file upload endpoints, media gateways, and web application firewalls.
Sandbox media decoding workloads using seccomp, AppArmor, or container isolation to limit the blast radius of memory corruption.

bash

# Configuration example: rebuild FFmpeg without ADX support
./configure \
  --disable-decoder=adpcm_adx \
  --disable-demuxer=adx \
  --enable-hardcoded-tables
make && make install