CVE-2026-66040 Overview
CVE-2026-66040 is a heap out-of-bounds write vulnerability in FFmpeg's native PNG and Animated PNG (APNG) encoders. The flaw affects FFmpeg versions through 8.1.2 and was corrected in commit b506faf. Attackers exploit the flaw by supplying a crafted PNG image containing a malicious eXIf chunk. The encoder underestimates the required allocation size, then writes tens of thousands of bytes past the buffer boundary during chunk serialization. The condition produces deterministic heap corruption, process termination, and creates conditions that may enable arbitrary code execution [CWE-122].
Critical Impact
Remote attackers can trigger deterministic heap corruption in any application, service, or pipeline that re-encodes attacker-supplied PNG or APNG data through FFmpeg, with potential for arbitrary code execution.
Affected Products
- FFmpeg versions through 8.1.2 (native PNG encoder)
- FFmpeg versions through 8.1.2 (native APNG encoder)
- Downstream applications, media services, and transcoding pipelines that link against vulnerable FFmpeg builds
Discovery Timeline
- 2026-07-24 - CVE-2026-66040 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-66040
Vulnerability Analysis
The vulnerability resides in FFmpeg's native PNG and APNG encoder paths that emit EXIF metadata via the eXIf PNG chunk. Before writing the chunk, the encoder calls add_exif_profile_size() to estimate the output buffer required for canonical EXIF serialization. That estimator does not account for cases where multiple Image File Directory (IFD) entries reference the same large value payload. During canonical serialization, each referencing IFD entry emits its own copy of the payload, expanding the output well past the pre-computed size. png_write_chunk() then writes the oversized payload into the undersized heap buffer, corrupting adjacent allocations.
Root Cause
The root cause is an incorrect size calculation in add_exif_profile_size(). The function computes required capacity assuming shared value payloads remain shared on output. Canonical EXIF serialization does not preserve that sharing and materializes each reference independently. The discrepancy between the estimated size and the actual serialized size is attacker-controlled through the number and layout of IFD entries in the crafted eXIf chunk.
Attack Vector
Exploitation requires the target to encode a PNG or APNG file supplied by the attacker. Any pipeline that ingests untrusted images and re-encodes them with FFmpeg is exposed. This includes media conversion services, thumbnail generators, video processing backends, and messaging platforms. The attacker crafts a PNG containing an eXIf chunk with multiple IFD entries that alias one large value payload. When FFmpeg encodes the output, png_write_chunk() overflows the heap buffer by tens of thousands of bytes, producing deterministic corruption suitable for control-flow hijack primitives.
No verified proof-of-concept code is publicly available. Refer to the VulnCheck Security Advisory and the FFmpeg fix in commit b506faf for technical details.
Detection Methods for CVE-2026-66040
Indicators of Compromise
- Crashes or aborts in processes linked against libavcodec while encoding PNG or APNG output
- Heap corruption signatures from allocator diagnostics (glibc malloc errors, ASan reports) inside png_write_chunk or add_exif_profile_size frames
- Inbound PNG or APNG files containing eXIf chunks with multiple IFD entries pointing to the same value offset
Detection Strategies
- Deploy fuzzing or static inspection over uploaded PNG and APNG files to flag eXIf chunks whose IFD entries reference overlapping large value payloads
- Correlate media transcoder crashes with the image inputs that preceded them; treat repeated crashes on user-supplied content as suspicious
- Inventory processes loading libavcodec and identify versions at or below 8.1.2 that have not integrated commit b506faf
Monitoring Recommendations
- Log FFmpeg command invocations, input hashes, and process exit codes on media processing hosts
- Alert on segmentation faults or SIGABRT events from encoder worker processes
- Forward endpoint and container runtime telemetry to a centralized data lake for cross-host correlation of encoder crashes
How to Mitigate CVE-2026-66040
Immediate Actions Required
- Upgrade FFmpeg to a build that includes commit b506faf or to the next tagged release after 8.1.2
- Rebuild and redeploy any downstream software that statically links libavcodec or bundles FFmpeg binaries
- Restrict PNG and APNG re-encoding to sandboxed workers with strict resource and syscall limits until patched builds are rolled out
Patch Information
The fix is delivered in FFmpeg commit b506faf, which corrects the size accounting in add_exif_profile_size() so that canonical serialization of duplicated IFD value references fits within the allocated chunk buffer. See the FFmpeg commit and associated FFmpeg Pull Request #23786 for the authoritative change set.
Workarounds
- Strip or reject PNG and APNG inputs that contain eXIf chunks before invoking FFmpeg encoders
- Disable EXIF metadata pass-through in transcoding jobs where preservation is not required
- Isolate encoder processes with seccomp, AppArmor, or container sandboxing to contain heap corruption impact
# Configuration example: strip metadata before re-encoding to avoid eXIf processing
ffmpeg -i untrusted_input.png -map_metadata -1 -f apng sanitized_output.apng
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
