CVE-2026-96611: FFmpeg Buffer Overflow Vulnerability

CVE-2026-96611 Overview

CVE-2026-96611 is a signed integer overflow vulnerability in FFmpeg versions before 9.0. The flaw resides in libavformat/mov.c, specifically within the mov_read_ispe() and read_image_grid() functions used to parse HEIF (High Efficiency Image Format) container metadata. A crafted ispe box containing oversized uint32_t width and height values is stored into signed integer fields without bounds checking. When these values are later accumulated in read_image_grid(), the arithmetic wraps under signed overflow semantics and bypasses downstream validity checks. This flaw is classified under [CWE-190] (Integer Overflow or Wraparound).

Critical Impact
Processing a malicious HEIF file can trigger undefined behavior leading to memory corruption, impacting confidentiality and integrity of the host running FFmpeg.

Affected Products

FFmpeg versions prior to 9.0
Applications and services embedding vulnerable libavformat builds
Media pipelines processing untrusted HEIF/HEIC content

Discovery Timeline

2026-09-23 - CVE-2026-96611 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96611

Vulnerability Analysis

The vulnerability originates in FFmpeg's HEIF parsing path. The mov_read_ispe() function reads image spatial extent (ispe) box dimensions as unsigned 32-bit integers from the input file. These values are then stored directly into signed integer fields with no validation that they fall within INT_MAX. Any width or height greater than INT_MAX becomes a negative signed value after the assignment.

The flawed values propagate to read_image_grid(), which accumulates the dimensions during grid image reconstruction. Signed integer overflow is undefined behavior per the C17 standard, section 6.5. On x86 targets the wrap produces a small positive result, which bypasses subsequent size sanity checks. Downstream allocations and copy operations then operate on attacker-influenced sizes, opening the door to memory corruption.

Root Cause

The root cause is missing bounds validation when casting uint32_t dimension fields into signed integers inside mov_read_ispe(). FFmpeg trusts the container-supplied values and defers all sanity checking to later stages that themselves assume non-negative inputs.

Attack Vector

Exploitation requires an attacker to supply a malicious HEIF file to a system running a vulnerable FFmpeg build. Local access is required, which limits scope but does not eliminate risk in transcoding services, thumbnail generators, and desktop media applications. No authentication or user interaction beyond opening the file is required.

No public proof-of-concept exploit is currently available. Technical remediation details are documented in the FFmpeg Commit Update and FFmpeg Pull Request #23455.

Detection Methods for CVE-2026-96611

Indicators of Compromise

HEIF or HEIC files whose ispe box declares width or height values exceeding INT_MAX (0x7FFFFFFF).
FFmpeg or libavformat-linked processes crashing with SIGSEGV or SIGABRT while decoding image container metadata.
Anomalous memory allocation failures or heap corruption in media transcoding worker processes.

Detection Strategies

Statically inspect HEIF containers to validate ispe dimensions before passing files to FFmpeg-based decoders.
Deploy fuzzing harnesses against media parsers to identify additional integer-handling defects in ingest pipelines.
Monitor process telemetry for repeated crashes or abnormal terminations of media conversion workloads.

Monitoring Recommendations

Log FFmpeg command-line invocations and captured stderr output from transcoding hosts.
Alert on unexpected child process termination signals produced by media libraries during automated jobs.
Track version inventory of FFmpeg binaries and embedded libavformat builds across the environment.

How to Mitigate CVE-2026-96611

Immediate Actions Required

Upgrade FFmpeg to version 9.0 or later on all systems that process untrusted media.
Rebuild and redeploy any application that statically links or bundles vulnerable libavformat code.
Restrict which users and services may submit HEIF content to shared transcoding infrastructure.

Patch Information

The fix is available in FFmpeg 9.0. Review the upstream change in the FFmpeg Commit Update and the associated FFmpeg Pull Request #23455. The patch enforces bounds checking on the uint32_t width and height values parsed from the ispe box before assigning them to signed integer fields.

Workarounds

Disable HEIF and HEIC decoding in FFmpeg build configurations where the format is not required.
Sandbox media parsing processes with seccomp, AppArmor, or container isolation to contain memory corruption impact.
Pre-filter incoming media through a validator that rejects ispe dimensions exceeding sane maximums (for example, 65535 pixels).

bash

# Verify installed FFmpeg version and upgrade path
ffmpeg -version | head -n1
# On Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade ffmpeg
# On RHEL/Fedora
sudo dnf upgrade ffmpeg