CVE-2026-66039

EUVD-2026-48741

24.07.2026, 20:18

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 23.09%

Affected Products (NVD)

Vendor	Product	Version
ffmpeg	ffmpeg	𝑥 ≤ 8.1.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	postponed
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

bionic	Fixed 7:3.4.11-0ubuntu0.1+esm13 released
focal	Fixed 7:4.2.7-0ubuntu0.1+esm14 released
jammy	Fixed 7:4.4.2-0ubuntu0.22.04.1+esm13 released
noble	Fixed 7:6.1.1-3ubuntu5+esm11 released
resolute	needed
xenial	Fixed 7:2.8.17-0ubuntu0.1+esm15 released

libav

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libavcodec-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.73.1 fixed

libavcodec57

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libavcodec58_134

suse enterprise desktop 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.52.1 fixed

libavformat-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.73.1 fixed

libavformat57

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.73.1 fixed

libavformat58_76

suse enterprise desktop 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.52.1 fixed

libavresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.73.1 fixed

libavresample3

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.73.1 fixed

libavutil-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libavutil55

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libavutil56_70

suse enterprise desktop 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.52.1 fixed

libpostproc-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libpostproc54

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libpostproc55_9

suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed

libswresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libswresample2

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libswresample3_9

suse enterprise desktop 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.52.1 fixed

libswscale-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libswscale4

suse enterprise desktop 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.73.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.73.1 fixed

libswscale5_9

suse enterprise desktop 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.72.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.52.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.52.1 fixed

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631

https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file