CVE-2026-66036: FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinitfilter 0 option. Attackers can provide a malicious video input where vfhqdn3d.configinput() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoisespatial() to write beyond the allocation boundary, resulting in heap memory corruption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg vf_hqdn3d filterto a version that resolves this vulnerability.Patch 5d7112c - Configuration
Do not disable filtergraph reinitialization; avoid using the -reinit_filter 0 option, since the vulnerability is triggered when reinitialization is disabled.
FFmpeg filtergraph -reinit_filter = 1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66036?
CVE-2026-66036 has a high severity rating of 8.8.
How do I fix CVE-2026-66036?
To fix CVE-2026-66036, you should update to FFmpeg version 8.1.3 or later.
What is the impact of CVE-2026-66036?
CVE-2026-66036 allows attackers to corrupt heap memory through a crafted video.
Which versions of FFmpeg are affected by CVE-2026-66036?
FFmpeg versions up to and including 8.1.2 are affected by CVE-2026-66036.
What is the nature of the vulnerability in CVE-2026-66036?
CVE-2026-66036 is a heap out-of-bounds write vulnerability in the vf_hqdn3d filter.