DEBIAN-CVE-2026-66036
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-66036
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-66036.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-66036
- Upstream
- Published
- 2026-07-24T20:18:20Z
- Modified
- 2026-09-01T16:06:56Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.
- References
Affected packages
Debian:12 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:deb/debian/ffmpeg?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
7:5.*
7:5.1.3-1
7:5.1.3-2
7:5.1.4-0+deb12u1
7:5.1.5-0+deb12u1
7:5.1.6-0+deb12u1
7:5.1.7-0+deb12u1
7:5.1.8-0+deb12u1
7:5.1.9-0+deb12u1
7:6.*
7:6.0-1
7:6.0-2
7:6.0-3
7:6.0-4
7:6.0-5
7:6.0-6
7:6.0-7
7:6.0-8
7:6.0-9
7:6.1-1
7:6.1-2
7:6.1-3
7:6.1-4
7:6.1-5
7:6.1.1-1
7:6.1.1-2
7:6.1.1-3
7:6.1.1-4
7:6.1.1-5
7:7.*
7:7.0-1
7:7.0.1-1
7:7.0.1-2
7:7.0.1-3
7:7.0.1-4
7:7.0.1-5
7:7.0.2-1
7:7.0.2-2
7:7.0.2-3
7:7.1-1
7:7.1-2
7:7.1-3
7:7.1-4
7:7.1.1-1
7:7.1.2-1
7:7.1.3-1
7:8.*
7:8.0-1
7:8.0-2
7:8.0.1-1
7:8.0.1-2
7:8.0.1-3
7:8.1-1
7:8.1-2
7:8.1-3
7:8.1.1-1
7:8.1.1-2
7:8.1.1-3
7:8.1.1-4
7:8.1.2-1
7:8.1.2-2
7:9.*
7:9.0-1
7:9.0.1-1
Debian:13 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:deb/debian/ffmpeg?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:deb/debian/ffmpeg?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected