CVE-2026-66037

What it is

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. High risk of service disruption.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-07-24 20:18 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-08-07 00:58 UTC Last updatedMost recent change to the record

Details

Published

2026-07-24 20:18 UTC

Last modified

2026-08-07 00:58 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-770 · Allocation without limits

Record status

Analyzed

Affected

• Ffmpeg ≤ 8.1.2

Attack profile CVSS 4.0 · 7.1

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

Passive

Confidentiality

None

Integrity

None

Availability

High