CVE-2026-65705

The record

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.

Affected packages

Related vulnerabilities

• CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-131
• CVE-2026-88830 A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a… CWE-131
• CVE-2026-84448 libheif is a HEIF and AVIF file format decoder and encoder. CWE-131
• CVE-2026-22590 eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard… CWE-131
• CVE-2026-78221 An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN… CWE-131
• CVE-2026-18743 A flaw was found in popt. CWE-131
• CVE-2026-78002 A flaw was found in rsyslog. CWE-131
• CVE-2026-16924 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a… CWE-131