CVE-2026-66037 FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()

High 7.1 Published 24 Jul 2026 Updated 28 Jul 2026

An attacker can cause denial of service in FFmpeg by triggering excessive memory allocation via a crafted IAMF file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-66037?

CVE-2026-66037 is a high-severity denial of service vulnerability in Ffmpeg Ffmpeg, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.

Weakness: CWE-770

Which versions are affected by CVE-2026-66037?

It affects 1 product.

Products include Ffmpeg Ffmpeg.

How do I fix CVE-2026-66037?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-66037 being exploited?

There is no known exploitation of CVE-2026-66037 in the wild and no public exploit code.

All Ffmpeg Ffmpeg vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-66037, ECHO-db22-c42b-7dfb, GHSA-qqrg-chvw-q8jp, JLSEC-2026-1183, MINI-9ccp-9qjm-r2qw, UBUNTU-CVE-2026-66037.