CVE-2026-66041: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-66041 is a heap out-of-bounds write vulnerability in FFmpeg's vf_quirc filter, affecting versions 7.0 through 8.1.2. An attacker can exploit this by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions, causing heap memory corruption and potentially enabling arbitrary code execution. The vulnerability was disclosed on July 24, 2026, and is fixed in commit 4da9812. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, VulnCheck).

The root cause is an out-of-bounds write (CWE-787) in FFmpeg's vf_quirc video filter, which integrates the libquirc QR code detection library. When processing a PGS/SUP subtitle file, the filter allocates a grayscale image buffer based on the dimensions of the first subtitle presentation. If a subsequent presentation has larger dimensions, av_image_copy_plane() copies data exceeding the initial allocation size into the undersized buffer, resulting in a heap overflow. Exploitation requires user interaction — specifically, a victim must process a crafted subtitle file with FFmpeg — but no authentication or special privileges are required from the attacker (GitHub Advisory, VulnCheck).

Successful exploitation can result in heap memory corruption, leading to a process crash (denial of service) or, in more severe scenarios, arbitrary code execution in the context of the FFmpeg process. All three security pillars are affected: confidentiality, integrity, and availability are rated High. Systems that automatically process user-supplied or remotely fetched media files (e.g., media servers, transcoding pipelines, video platforms) are at elevated risk, as a single malicious subtitle file could compromise the processing host (GitHub Advisory, VulnCheck).

1. Craft a malicious PGS/SUP subtitle file: Create a PGS/SUP subtitle file where the first presentation segment defines a small frame dimension (e.g., 100x100 pixels) and a subsequent presentation segment specifies significantly larger dimensions (e.g., 1920x1080 pixels), causing a dimension mismatch.
2. Deliver the file to the target: Distribute the crafted subtitle file to a victim via email attachment, a malicious media download link, a shared media repository, or by embedding it alongside a video file in a container format.
3. Trigger FFmpeg processing: Induce the victim or an automated system to process the file using FFmpeg with the vf_quirc filter active (e.g., ffmpeg -i input.mkv -vf quirc output.mp4), or rely on a media application that internally invokes FFmpeg for subtitle rendering.
4. Trigger heap overflow: When FFmpeg processes the second subtitle presentation, av_image_copy_plane() copies image data based on the larger dimensions into the undersized libquirc grayscale buffer allocated for the first (smaller) dimensions, writing beyond the buffer boundary.
5. Achieve code execution or crash: The heap corruption may overwrite adjacent heap metadata or function pointers, potentially enabling arbitrary code execution under the FFmpeg process's privileges, or at minimum causing a process crash (GitHub Advisory, VulnCheck).

• Process: FFmpeg process crashing unexpectedly or producing segmentation faults when processing subtitle-containing media files; unusual child processes spawned by FFmpeg (e.g., shells or network utilities).
• File System: Presence of unexpected or externally sourced .sup or .pgs subtitle files in media processing directories; core dump files generated by FFmpeg crashes.
• Logs: Application or system logs showing FFmpeg abort signals (SIGABRT, SIGSEGV) correlated with subtitle file processing; heap corruption error messages from memory allocators (e.g., glibc's malloc: corrupted top size).
• Network: Outbound connections from the FFmpeg process or its parent application to unexpected external hosts following subtitle file processing, which may indicate post-exploitation activity.

Update FFmpeg to a version beyond 8.1.2 that includes commit 4da9812e25894fb51d62a8875cfa8eb39b5e20f5, which resolves the dimension mismatch handling in the vf_quirc filter. As an interim workaround, avoid using the vf_quirc filter when processing subtitle files from untrusted sources, or disable subtitle processing entirely in automated pipelines until the patch is applied. Additionally, implementing input validation to enforce consistent frame dimensions across subtitle presentations can reduce exposure (GitHub Advisory, VulnCheck).

The vulnerability received brief coverage from The Hacker Wire, which published a dedicated article on the FFmpeg heap out-of-bounds write in the vf_quirc filter shortly after disclosure (The Hacker Wire). A Mastodon post from The Hacker Wire account also noted the vulnerability. No significant vendor statements, major researcher commentary, or widespread community discussion have been observed beyond standard CVE aggregator coverage.