CVE-2026-65706

EUVD-2026-48373

23.07.2026, 20:17

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 8.41%

Affected Products (NVD)

Vendor	Product	Version
ffmpeg	ffmpeg	3.0 ≤ 𝑥 ≤ 8.1.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	postponed
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

bionic	Fixed 7:3.4.11-0ubuntu0.1+esm15 released
focal	Fixed 7:4.2.7-0ubuntu0.1+esm16 released
jammy	Fixed 7:4.4.2-0ubuntu0.22.04.1+esm15 released
noble	Fixed 7:6.1.1-3ubuntu5+esm13 released
resolute	needed
xenial	not-affected

libav

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libavcodec-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavcodec57

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavformat-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavformat57

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavresample3

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil55

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libpostproc-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libpostproc54

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswresample2

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswscale-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswscale4

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

Common Weakness Enumeration

CWE-131 - Incorrect Calculation of Buffer Size
The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Vulnerability Media Exposure

[GERMAN] ffmpeg: Mehrere Schwachstellen ermöglichen Codeausführung und DoS
Ein Angreifer kann mehrere Schwachstellen in ffmpeg ausnutzen, um beliebigen Programmcode auszuführen oder um einen Denial-of-Service-Zustand zu verursachen.
Published: 2026-07-23T22:00:00+00:00

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779

https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing