FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c Patch
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780 Issue Tracking, Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.3 · ffmpegNVD modified 2026-10-24 15:10
Affected (CPE criteria) 1
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*