CVE-2026-66037: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-66037 is an uncontrolled resource consumption vulnerability in FFmpeg's IAMF (Immersive Audio Model and Formats) demuxer, classified as a Denial of Service issue. It affects FFmpeg through version 8.1.2 and was disclosed on July 24, 2026, with a fix available in commit 5d7112c (git hash 86708357d126af84c16f80d9c57335d1e8c845c5). An unauthenticated attacker can trigger multi-gigabyte memory allocation from a crafted 17-byte input file, exhausting process memory or causing an OOM-kill. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, VulnCheck).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in the mix_presentation_obu() function within libavformat/iamf_parse.c. The function calls av_calloc(count_label, sizeof(*language_label)) using an attacker-controlled count_label value before validating whether sufficient OBU (Open Bitstream Unit) data is actually present in the input. This premature allocation enables an amplification ratio of approximately 126 million bytes per input byte — meaning a 17-byte crafted IAMF file can trigger gigabytes of memory allocation during format probing. The vulnerability is exploitable over the network with no privileges required, though it requires passive user interaction (e.g., a user or application opening a crafted file) (GitHub Advisory, VulnCheck).

Successful exploitation causes the FFmpeg process to exhaust available system memory, resulting in process termination via OOM-kill or a complete denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Applications and services that rely on FFmpeg for media processing (e.g., video platforms, transcoding pipelines, media players) could be disrupted or crashed by processing a single malicious file, with no lateral movement or data exfiltration risk (GitHub Advisory, VulnCheck).

1. Craft a malicious IAMF file: Create a minimal IAMF-formatted file (as small as 17 bytes) with a crafted count_label field in the mix_presentation_obu structure set to a very large value (e.g., near the maximum integer), while keeping the actual OBU data payload minimal or absent.
2. Deliver the file to the target: Distribute the crafted file via any channel that causes FFmpeg to process it — such as uploading to a media platform, sending via a messaging application that auto-generates previews, or embedding in a web page that triggers media probing.
3. Trigger format probing: FFmpeg automatically probes the file format upon opening, invoking mix_presentation_obu() in libavformat/iamf_parse.c, which calls av_calloc(count_label, sizeof(*language_label)) with the attacker-supplied large count_label value before any OBU data validation occurs.
4. Memory exhaustion: The allocation amplification (~126 million bytes per input byte) rapidly exhausts available process memory, causing the FFmpeg process to be killed by the OS OOM killer or crash, resulting in denial of service (GitHub Advisory, VulnCheck).

• Process Behavior: FFmpeg process consuming abnormally large amounts of RAM (multi-gigabyte) shortly after opening a small media file; FFmpeg process terminated unexpectedly with OOM-kill signals (e.g., kernel log entries: Out of memory: Kill process [pid] (ffmpeg)).
• Logs: System logs (/var/log/syslog, dmesg) showing OOM-killer events triggered by the FFmpeg process; application logs recording crashes or unexpected exits during media format probing of IAMF files.
• File System: Presence of unusually small (e.g., <100 bytes) files with .iamf or generic media extensions submitted to upload endpoints or found in processing queues.
• Network: Unexpected upload of very small media files to services that auto-process or transcode media content.

Update FFmpeg to a version containing the fix from commit 5d7112c (git hash 86708357d126af84c16f80d9c57335d1e8c845c5), which adds validation of available OBU data before performing the count_label-based allocation. As interim workarounds: restrict FFmpeg from processing untrusted IAMF files, implement OS-level memory limits (e.g., ulimit -v) on FFmpeg processes to cap maximum memory allocation, or disable IAMF demuxer support at compile time if not required. Organizations running media processing pipelines exposed to user-supplied content should prioritize patching (GitHub Advisory, VulnCheck).