CVE-2026-52297: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-52297 is a low-severity out-of-bounds read vulnerability in FFmpeg affecting all versions before 9.0. The flaw exists in the MOV parsing path within the mov_read_iacb function in libavformat/mov.c, where codec extradata is allocated without the required padding before bitreader access. It was discovered by Kenan Alghythee (University of Illinois Chicago) and collaborators, disclosed on September 13, 2026, and patched via FFmpeg upstream PR #22988. It carries a CVSS v3.1 base score of 2.9 (Low) (Github Advisory, Researcher Reference).

The root cause is CWE-125 (Out-of-bounds Read): codec extradata in libavformat/mov.c is allocated without the required AV_INPUT_BUFFER_PADDING_SIZE padding before subsequent GetBitContext-based bitreader access. The vulnerability was introduced by commit fe637161dbe64cccae98ca20c193ef25bebca02e and affects the mov_read_iacb function specifically. An attacker must supply a specially crafted MOV file with insufficient padding in the extradata field to trigger a heap-buffer-overflow on read, causing a crash. The fix was merged in FFmpeg master commit 8439e0203744a30d280668fcd086f74ed5001da1 as part of PR #22988 (Researcher Reference, Github Advisory).

Successful exploitation results in a denial-of-service condition, causing the FFmpeg process to crash when parsing a maliciously crafted MOV file. There is no impact on confidentiality or integrity — only availability is affected, and only at a low level given the local attack vector and high attack complexity. Applications or services that automatically process user-supplied MOV media files (e.g., transcoding pipelines, media servers) are most at risk (Github Advisory, Researcher Reference).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is local with high attack complexity, significantly limiting the practical exploitability of this issue (Github Advisory).

1. Craft a malicious MOV file: Construct a MOV file with an iacb box containing codec extradata that is allocated without the required padding bytes (AV_INPUT_BUFFER_PADDING_SIZE), exploiting the insufficient padding in the mov_read_iacb parsing path.
2. Deliver the file to the target: Place the crafted MOV file in a location where a vulnerable FFmpeg instance (version < 9.0) will process it — for example, a media transcoding pipeline, a video processing script, or a media server that ingests user-supplied files.
3. Trigger parsing: Cause FFmpeg to parse the malicious MOV file (e.g., via ffmpeg -i malicious.mov ... or through an application that calls libavformat).
4. Achieve denial of service: The mov_read_iacb function reads extradata past the allocated buffer boundary, triggering a heap-buffer-overflow on read and crashing the FFmpeg process (Researcher Reference).

• Process: FFmpeg process terminating unexpectedly or with a segmentation fault / heap-buffer-overflow error when processing MOV files.
• Logs: ASAN (AddressSanitizer) crash reports referencing mov_read_iacb in libavformat/mov.c; application logs showing FFmpeg crashes on specific MOV inputs.
• File System: Presence of unexpected or anomalous MOV files submitted to media processing directories, particularly those with unusual or malformed iacb box structures.
• Network: Repeated submission of the same or similar MOV files to a media processing endpoint, potentially indicating automated crash-triggering attempts (Researcher Reference).

Upgrade FFmpeg to version 9.0 or later, which includes the fix merged in upstream PR #22988 (commit 8439e0203744a30d280668fcd086f74ed5001da1). Until patching is possible, restrict the processing of untrusted or user-supplied MOV files and implement input validation on media files from untrusted sources. Sandboxing FFmpeg processes can also limit the impact of a crash (Github Advisory, Researcher Reference).