Uncontrolled Resource Consumption in FFmpeg <8.1.2 IAMF Demuxer
CVE-2026-66037 Published on July 24, 2026
FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.
Vulnerability Analysis
CVE-2026-66037 can be exploited with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Products Associated with CVE-2026-66037
Want to know whenever a new CVE is published for FFmpeg? stack.watch will email you.
Affected Versions
FFmpeg:- Before and including 8.1.2 is affected.
- Version 86708357d126af84c16f80d9c57335d1e8c845c5 is unaffected.