CVE-2026-66036 FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter

High 7.7 Published 24 Jul 2026 Updated 29 Jul 2026

Attackers can corrupt heap memory and potentially execute code by supplying crafted video files to FFmpeg when filtergraph reinitialization is disabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-66036?

CVE-2026-66036 is a high-severity memory corruption vulnerability in Ffmpeg Ffmpeg, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.

Weakness: CWE-122

Which versions are affected by CVE-2026-66036?

It affects 1 product.

Products include Ffmpeg Ffmpeg.

How do I fix CVE-2026-66036?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-66036 being exploited?

There is no known exploitation of CVE-2026-66036 in the wild and no public exploit code.

All Ffmpeg Ffmpeg vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-66036, ECHO-cd22-8b98-8dc9, GHSA-575m-jfmw-q76c, JLSEC-2026-1182, MINI-722g-6h8w-qv2c, UBUNTU-CVE-2026-66036.