7.1

CVE-2026-66037: ffmpeg

CVSS: 7.1v4.0HighAnalyzed
AliasesUBUNTU-CVE-2026-66037DEBIAN-CVE-2026-66037CGA-5r59-6h87-xg43
Published 24-07-2026Last modified 28-07-2026
Open JSON

Vulnerability summary

CVE-2026-66037 is a high (CVSS 7.1) vulnerability in ffmpeg. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v4.0 (CVE.org)
EPSS score
0.35%
0%100%
Low · +0.14 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 5
MGASA-2026-0398OPENSUSE-SU-2026:11545-1OPENSUSE-SU-2026:11665-1OPENSUSE-SU-2026:11682-1OPENSUSE-SU-2026:21877-1CGA-HMFW-CHM4-3VF4

Timeline

  1. 24-07-2026
    PublishedVulnerability first disclosed.
  2. 28-07-2026
    Last modifiedVulnerability information updated.

Description

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.

CVSS metrics

9 scores · 6 sources · 2 versions

EPSS trend

Probability

0.35%

Chance of exploitation in the next 30 days

Percentile

27%

Versus all other CVEs

30-day change

+0.14 pp

From 0.21% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.35%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard18 products
  • eco-python-ffmpeg-6-minimalAll versions (No fix recorded)
  • eco-python-ffmpeg-6-minimal-devAll versions (No fix recorded)
  • eco-python-ffmpeg-6-minimal-staticAll versions (No fix recorded)
  • eco-python-ffmpeg-7-minimalAll versions (No fix recorded)
  • eco-python-ffmpeg-7-minimal-devAll versions (No fix recorded)
Wolfi4 products
  • ffmpeg-7All versions (No fix recorded)
  • ffmpeg-7.1All versions (No fix recorded)
  • ffmpeg-8.0All versions (No fix recorded)
  • ffmpeg-8.1< 8.1.3-r0
Debian1 product
  • ffmpegAll versions (No fix recorded) | < 7:9.0.2-1
Ffmpeg1 product
Ubuntu1 product
  • ffmpegAll versions (No fix recorded)

5 vendors · 25 products

References

9 links