CVE-2026-66039: FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File
FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpacket and framesperpacket values in the desc chunk to trigger an integer overflow in macedecodeframe() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg MACE6 audio decoder (CAF)to a version that resolves this vulnerability.Fixed in 8.1.2
Event History
Frequently Asked Questions
What is CVE-2026-66039?
CVE-2026-66039 is a vulnerability in FFmpeg's MACE6 audio decoder that allows heap out-of-bounds writes due to a signed integer overflow when processing crafted CAF files.
What is the severity of CVE-2026-66039?
CVE-2026-66039 has a high severity rating of 8.8 on the CVSS scale.
How do I fix CVE-2026-66039?
To fix CVE-2026-66039, upgrade FFmpeg to a version beyond 8.1.2 where the vulnerability has been patched.
What impacts does CVE-2026-66039 have on systems?
CVE-2026-66039 can allow attackers to corrupt heap memory, potentially leading to remote code execution or system crashes.
Which versions of FFmpeg are affected by CVE-2026-66039?
CVE-2026-66039 affects FFmpeg versions up to 8.1.2.