CVE-2026-66037: FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationobu() function in libavformat/iamfparse.c calls avcalloc(countlabel, sizeof(languagelabel)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpegto a version that resolves this vulnerability.Patch 5d7112c - Compensating control
To reduce risk during format probing, limit exposure of FFmpeg-based services (IAMF demuxing/format probing) to untrusted inputs by isolating the parsing process (e.g., run in a sandbox/container with strict memory limits) so allocation amplification cannot exhaust host memory.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66037?
CVE-2026-66037 has a medium severity score of 6.5.
How do I fix CVE-2026-66037?
To fix CVE-2026-66037, update to the latest version of FFmpeg that includes the fix from commit 5d7112c.
What type of vulnerability is CVE-2026-66037?
CVE-2026-66037 is an uncontrolled resource consumption vulnerability.
What is the impact of CVE-2026-66037?
CVE-2026-66037 can allow an unauthenticated attacker to cause excessive memory allocation even with a small input file.
Which software is affected by CVE-2026-66037?
CVE-2026-66037 affects the IAMF demuxer component of FFmpeg versions up to 8.1.2.