DEBIAN-CVE-2026-66037
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-66037
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-66037.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-66037
- Upstream
- Published
- 2026-07-24T20:18:20Z
- Modified
- 2026-09-01T16:06:56Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.
- References
Affected packages
Debian:12 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:deb/debian/ffmpeg?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
7:5.*
7:5.1.3-1
7:5.1.3-2
7:5.1.4-0+deb12u1
7:5.1.5-0+deb12u1
7:5.1.6-0+deb12u1
7:5.1.7-0+deb12u1
7:5.1.8-0+deb12u1
7:5.1.9-0+deb12u1
7:6.*
7:6.0-1
7:6.0-2
7:6.0-3
7:6.0-4
7:6.0-5
7:6.0-6
7:6.0-7
7:6.0-8
7:6.0-9
7:6.1-1
7:6.1-2
7:6.1-3
7:6.1-4
7:6.1-5
7:6.1.1-1
7:6.1.1-2
7:6.1.1-3
7:6.1.1-4
7:6.1.1-5
7:7.*
7:7.0-1
7:7.0.1-1
7:7.0.1-2
7:7.0.1-3
7:7.0.1-4
7:7.0.1-5
7:7.0.2-1
7:7.0.2-2
7:7.0.2-3
7:7.1-1
7:7.1-2
7:7.1-3
7:7.1-4
7:7.1.1-1
7:7.1.2-1
7:7.1.3-1
7:8.*
7:8.0-1
7:8.0-2
7:8.0.1-1
7:8.0.1-2
7:8.0.1-3
7:8.1-1
7:8.1-2
7:8.1-3
7:8.1.1-1
7:8.1.1-2
7:8.1.1-3
7:8.1.1-4
7:8.1.2-1
7:8.1.2-2
7:9.*
7:9.0-1
7:9.0.1-1
Debian:13 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:deb/debian/ffmpeg?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:deb/debian/ffmpeg?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected