CVE-2026-65704 FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder
Attackers can achieve code execution or denial of service via heap corruption in FFmpeg when processing crafted files with the -safe 0 flag.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-65704?
CVE-2026-65704 is a high-severity memory corruption vulnerability in Ffmpeg Ffmpeg, published on 23 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.
Which versions are affected by CVE-2026-65704?
It affects 1 product.
Products include Ffmpeg Ffmpeg.
How do I fix CVE-2026-65704?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-65704 being exploited?
There is no known exploitation of CVE-2026-65704 in the wild and no public exploit code.
Other vulnerabilities in Ffmpeg Ffmpeg
Sources
Also known as DEBIAN-CVE-2026-65704, ECHO-7d2e-9fad-304d, GHSA-98cx-cw6c-5pj4, JLSEC-2026-1179, MINI-fg4x-jh6j-c22h, UBUNTU-CVE-2026-65704.