GCVE-1-2026-0002: ffmpeg Heap-based Buffer Overflow

Vulnerability summary

GCVE-1-2026-0002 is a critical (CVSS 10.0) Heap-based Buffer Overflow vulnerability in ffmpeg.

Timeline

1. 02-01-2026
   PublishedVulnerability first disclosed.
2. 02-01-2026
   Last modifiedVulnerability information updated.

Description

Heap-buffer-overflow in EXIF writer for extra IFD tags | Pwno We recently found a cool four-bytes heap-buffer-overflow in FFmpeg's `avcodec/exif` during the processing of IFDs _(Image File Directory)._ This affects `.png`, `.jpg`, `.webp`, `.avif` … the formats we use most often. The cause of this bug is very interesting, and I don’t want to spoil it here; I want you to find out. It’s also a short in-depth dive of FFmpeg internal workings of EXIFs, something we use so often. So even if you’re not really into memory bugs, this can be a cool way to learn how it works under the hood.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().