CVE-2026-65706: FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ffmpeg/vf_swaprectto a version that resolves this vulnerability.Fixed in 8.1.2 - Compensating control
Avoid processing NV12 frames with odd width dimensions through the ffmpeg vf_swaprect video filter (use even-width NV12 frames or a different filter).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65706?
CVE-2026-65706 has a severity score of 7.8, categorized as high.
How do I fix CVE-2026-65706?
To fix CVE-2026-65706, upgrade FFmpeg to a version greater than 8.1.2.
What is the risk associated with CVE-2026-65706?
CVE-2026-65706 poses a risk of heap memory corruption through crafted NV12 video frames.
Which versions of FFmpeg are affected by CVE-2026-65706?
FFmpeg versions 3.0 through 8.1.2 are affected by CVE-2026-65706.
What type of vulnerability is CVE-2026-65706?
CVE-2026-65706 is an out-of-bounds write vulnerability in the vf_swaprect video filter.