CVE-2026-96611: Integer Overflow
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe(), uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpegto a version that resolves this vulnerability.Patch 059eb2e853
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
FFmpeg versions before 9.0 are affected when they process a crafted HEIF image containing an ispe box. The recorded attack vector is local.
What does an attacker need to exploit it?
An attacker needs a crafted HEIF file whose ispe width or height values exceed INT_MAX and that reaches image-grid processing. No privileges or user interaction are required, although the attack complexity is rated high.
How can I determine whether an installation is affected?
Check the installed FFmpeg version. Versions earlier than 9.0 are affected; version 9.0 or later is not identified as affected by the supplied information.