CVE-2026-66039: FFmpeg MACE6 Audio Decoder RCE Vulnerability

CVE-2026-66039 Overview

CVE-2026-66039 is a signed integer overflow vulnerability in the FFmpeg MACE6 audio decoder. The flaw affects FFmpeg through version 8.1.2 and is fixed in commit aafb5c6. Attackers craft a Core Audio Format (CAF) file with oversized bytes_per_packet and frames_per_packet values in the desc chunk. Processing the malicious file triggers an integer overflow inside mace_decode_frame() during output sample count computation. The overflow leads to an undersized heap buffer allocation followed by an out-of-bounds write, which can enable arbitrary code execution in the process handling the file.

Critical Impact
A crafted CAF file processed by a vulnerable FFmpeg build corrupts the heap in mace_decode_frame() and can lead to remote code execution in any application or service that decodes untrusted audio input.

Affected Products

FFmpeg versions through 8.1.2
Applications and services that embed vulnerable FFmpeg libraries (libavcodec) for CAF/MACE6 decoding
Media pipelines, transcoders, and upload processors that accept untrusted audio files

Discovery Timeline

2026-07-24 - CVE-2026-66039 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-66039

Vulnerability Analysis

The vulnerability resides in the MACE6 audio decoder implemented in mace_decode_frame() inside libavcodec. When FFmpeg parses the desc chunk of a CAF container, it reads attacker-controlled bytes_per_packet and frames_per_packet fields. The decoder uses these values to compute the number of output samples for the frame. Multiplying oversized signed integers overflows the result, producing a small or negative value that is later used to size a heap buffer. The decoder then writes decoded samples into that undersized allocation, corrupting adjacent heap memory. The bug is categorized as a heap-based buffer overflow [CWE-122].

Root Cause

The root cause is missing bounds validation on the bytes_per_packet and frames_per_packet descriptors before they are used in arithmetic that determines allocation size. Signed integer arithmetic in the sample-count computation wraps around, so the buffer allocation call receives an attacker-influenced, undersized length while the write loop uses the original oversized counts.

Attack Vector

Exploitation requires an attacker to deliver a crafted CAF file to a target that decodes it with a vulnerable FFmpeg build. User interaction is required, such as opening a file, uploading media to a server-side transcoder, or previewing an attachment. No authentication is needed. Successful exploitation yields heap corruption, which a skilled attacker can shape into arbitrary code execution in the context of the decoding process.

No verified public proof-of-concept code is available. Refer to the FFmpeg commit aafb5c6 and the VulnCheck advisory for the technical fix and analysis.

Detection Methods for CVE-2026-66039

Indicators of Compromise

CAF files containing anomalously large bytes_per_packet or frames_per_packet values in the desc chunk
Crashes or aborts in processes linked against libavcodec while decoding audio, particularly with heap corruption signatures
Unexpected child processes or outbound connections spawned by media transcoding workers immediately after CAF ingestion

Detection Strategies

Inspect CAF uploads at the gateway and reject files whose desc chunk contains packet-size fields outside expected ranges for MACE6 audio
Monitor for FFmpeg or ffprobe crashes correlated with newly ingested audio files, especially SIGSEGV or heap allocator aborts
Hunt for anomalous process trees where transcoding services (ffmpeg, libavcodec consumers) launch shells, script interpreters, or network utilities

Monitoring Recommendations

Enable AddressSanitizer or hardened malloc on non-production build pipelines to surface heap corruption in decoder fuzzing
Log FFmpeg version and command lines across servers to identify unpatched deployments
Alert on media processing services that consume unusually large or malformed audio files just before a crash event

How to Mitigate CVE-2026-66039

Immediate Actions Required

Update FFmpeg to a build that includes commit aafb5c6 or later; rebuild any statically linked applications against the patched libraries
Inventory all systems, containers, and third-party applications that bundle FFmpeg or libavcodec and prioritize those that process user-supplied media
Restrict CAF and MACE-encoded audio at ingress points until patched builds are deployed

Patch Information

The fix is committed upstream as aafb5c655edc76a753275c383ebb139feb032718 and discussed in FFmpeg pull request 23631. The patch adds validation of bytes_per_packet and frames_per_packet before they are used in sample-count arithmetic inside mace_decode_frame(). Vendors that redistribute FFmpeg should backport the commit and publish updated packages.

Workarounds

Disable the MACE6 decoder at build time by configuring FFmpeg with --disable-decoder=mace6 if MACE audio is not required
Sandbox FFmpeg execution using seccomp, AppArmor, or a dedicated low-privilege container to limit the blast radius of heap corruption
Filter uploads to reject the CAF container format, or validate desc chunk fields before invoking FFmpeg

bash

# Rebuild FFmpeg without the MACE6 decoder as a temporary workaround
./configure --disable-decoder=mace6
make && make install

# Verify the decoder is no longer registered
ffmpeg -hide_banner -decoders | grep -i mace