Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-24T19:34:16 ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-787

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.

A flaw was found in FFmpeg. A remote attacker can exploit a heap out-of-bounds write vulnerability within the `vf_hqdn3d` filter by providing a specially crafted video file. When filtergraph reinitialization is disabled, the filter allocates undersized memory buffers for video frames. Subsequent larger frames can cause the application to write beyond these allocated boundaries, leading to heap memory corruption. This can result in arbitrary code execution or a denial of service.

Red Hat Enterprise Linux AI (RHEL AI) 3 Affected ffmpeg Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-aws-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-azure-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-azure-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gcp-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-vllm-gaudi-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-66036 https://nvd.nist.gov/vuln/detail/CVE-2026-66036 https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783 https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter