CVE-2026-66037: FFmpeg IAMF Demuxer DoS Vulnerability

CVE-2026-66037 Overview

CVE-2026-66037 is an uncontrolled resource consumption vulnerability [CWE-770] in the FFmpeg IAMF (Immersive Audio Model and Formats) demuxer. The flaw affects FFmpeg through version 8.1.2 and is fixed in commit 5d7112c. An unauthenticated attacker can trigger multi-gigabyte memory allocations from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data. This allocation amplification reaches approximately 126 million bytes per input byte, exhausting process memory or triggering an OOM-kill during format probing.

Critical Impact
A single crafted 17-byte file can force FFmpeg to allocate multi-gigabyte memory regions, exhausting host resources and enabling denial of service during automated media processing.

Affected Products

FFmpeg versions through 8.1.2
FFmpeg builds incorporating the IAMF demuxer prior to commit 5d7112c
Applications, services, and pipelines that link libavformat for media probing or demuxing

Discovery Timeline

2026-07-24 - CVE-2026-66037 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-66037

Vulnerability Analysis

The vulnerability resides in the IAMF demuxer's handling of Mix Presentation OBUs (Object-Based Units). When FFmpeg parses a Mix Presentation OBU, the mix_presentation_obu() function in libavformat/iamf_parse.c reads a count_label value directly from the input stream. The function passes this attacker-controlled count to av_calloc(count_label, sizeof(*language_label)) before verifying that the OBU actually contains enough remaining bytes to justify the allocation.

Because count_label is encoded as a variable-length integer, an attacker can specify a value up to roughly 2^32 while consuming only a handful of input bytes. Each unit in count_label triggers allocation of a language_label structure, yielding an amplification factor of approximately 126 million bytes per input byte. A 17-byte file is sufficient to request multi-gigabyte allocations.

Root Cause

The root cause is missing bounds validation between an untrusted, length-prefixed count field and the subsequent heap allocation. The demuxer trusts count_label before cross-checking it against the remaining OBU size or a sane upper bound. This pattern falls under CWE-770 (Allocation of Resources Without Limits or Throttling).

Attack Vector

Exploitation requires the target application to probe or demux an attacker-supplied file. Because FFmpeg probes formats automatically, any workflow that ingests untrusted media — transcoding services, thumbnail generators, upload processors, or media-sharing platforms — is reachable over the network. User interaction is limited to opening or uploading the crafted file. The result is memory exhaustion and process termination via the operating system's OOM killer.

No public proof-of-concept exploit is available. Refer to the Vulncheck Advisory on FFmpeg and the FFmpeg Commit Details for technical specifics.

Detection Methods for CVE-2026-66037

Indicators of Compromise

Sudden multi-gigabyte resident memory growth in ffmpeg, ffprobe, or any process linking libavformat
Kernel oom-kill events terminating media processing workers shortly after file ingestion
IAMF-formatted or unusually small input files (under 100 bytes) triggering process crashes during format probing

Detection Strategies

Monitor media-processing services for abnormal av_calloc allocation sizes and short-lived processes killed by the OOM handler.
Alert on repeated ffmpeg or ffprobe process restarts on ingestion hosts, particularly after uploads of files with the IAMF container signature.
Correlate upload metadata with worker memory spikes to identify malicious tenants or sources.

Monitoring Recommendations

Enable per-process memory ceilings and audit cgroup memory events on media transcoding hosts.
Log all inputs handed to ffmpeg/ffprobe alongside exit codes and peak RSS to surface anomalous ratios of input size to memory use.
Track dmesg and journal entries for Out of memory: Killed process events tied to media workloads.

How to Mitigate CVE-2026-66037

Immediate Actions Required

Upgrade FFmpeg to a build that includes commit 5d7112c or later, which validates count_label against available OBU data before allocation.
Rebuild and redeploy any first-party applications that statically link libavformat from a vulnerable source tree.
Enforce strict memory limits on FFmpeg worker processes using cgroups, ulimit, or container resource constraints.

Patch Information

The issue is fixed in FFmpeg commit 5d7112c. See FFmpeg Commit Details and FFmpeg Pull Request 23627 for the upstream fix. Downstream distributions and container base images should be updated once patched packages are published.

Workarounds

Disable the IAMF demuxer at build time or via the -f format whitelist when IAMF processing is not required.
Sandbox media processing in short-lived containers with hard memory limits so that OOM events remain contained.
Reject inputs that advertise the IAMF container type at an upstream gateway until patched binaries are deployed.

bash

# Configuration example: constrain ffmpeg worker memory via systemd
# /etc/systemd/system/ffmpeg-worker.service.d/limits.conf
[Service]
MemoryMax=1G
MemoryHigh=768M
TasksMax=64

# Or via docker run for containerized transcoders
docker run --memory=1g --memory-swap=1g --pids-limit=64 \
  --read-only ffmpeg:patched -i /input/file.iamf -f null -