CVE-2026-65704

Executive Summary

CVE-2026-65704 is an out-of-bounds write vulnerability in FFmpeg, affecting all versions through 8.1.2. The vulnerability resides in the interaction between the TY demuxer and the Shorten decoder, where a crafted ffconcat file processed with the -safe 0 flag can trigger heap corruption via an integer underflow that leads to an oversized memory copy operation. Successful exploitation allows an attacker to achieve arbitrary code execution with the privileges of the FFmpeg process, potentially leading to full system compromise when FFmpeg runs in privileged contexts. The vulnerability carries a CVSS score of 7.8 (High), with an EPSS score of 0.00126, indicating low current exploitation likelihood, and is not present on the CISA KEV list.

Technical Analysis

The vulnerability chain begins in the TY demuxer's demux_audio() function, which is responsible for parsing audio packets from TiVo-format media streams. When the demuxer processes a crafted audio packet, it decrements the packet's size field without performing a bounds check against the actual available data. This lack of validation allows the packet size to become negative — an integer underflow condition that is classified under CWE-191 (Integer Underflow).

This negative size value is then propagated downstream through FFmpeg's packet processing pipeline to the Shorten (SHN) decoder's shorten_decode_frame() function. When the decoder invokes memcpy() with this value, the negative integer is implicitly converted to size_t, which is an unsigned type. This conversion causes the value to wrap around to a number very close to SIZE_MAX (the maximum value representable by size_t, typically 18,446,744,073,709,551,615 on 64-bit systems).

The memcpy operation then attempts to read from source memory far beyond the actual allocated input buffer (out-of-bounds read) and writes to a destination address in the Shorten decoder's bitstream buffer that is also far beyond its allocation (out-of-bounds write). This results in massive heap corruption, which can be leveraged for arbitrary code execution through techniques such as heap spraying and overwriting function pointers or heap metadata.

The attack requires a crafted ffconcat file — FFmpeg's concat demuxer format that allows the sequential concatenation of multiple media files. The -safe 0 flag is critical because it disables path safety checks in the concat demuxer, permitting the inclusion of arbitrary file paths and enabling the attacker to reference a malicious TY-format file. Without -safe 0, the concat demuxer would reject unsafe paths, making exploitation significantly more difficult.

The attack surface is primarily local — an attacker must convince a victim to open a malicious media file. However, this is a common attack vector in media processing environments, as FFmpeg is frequently used in automated transcoding pipelines, media servers, and video editing applications where files are processed with minimal user interaction.

Exploitation Scenarios

Scenario 1: Malicious Media File Delivery via Web Application

1. Reconnaissance: An attacker identifies a media processing service that uses FFmpeg, such as a video sharing platform, media management tool, or a web application with an upload-and-transcode feature. The attacker confirms FFmpeg version 8.1.2 or earlier is in use, typically by triggering an error message or observing product banners.

2. Weaponization: The attacker crafts a malicious ffconcat file containing a reference to a TY-format media file with a specially crafted audio packet. The packet header declares a size that causes demux_audio() to underflow, producing a negative value. Tools like mkvalidator or custom Python scripts can be used to craft the malformed TY file structure.

3. Delivery: The attacker uploads the crafted ffconcat file to the web application's file upload endpoint, or delivers it via a spear-phishing email attachment to a user within an organization that uses FFmpeg-based tools.

4. Execution: The FFmpeg instance processes the file with the concat demuxer. If the application invokes FFmpeg with -safe 0 (common in scenarios where the application needs to concatenate dynamically generated file lists), the malicious path is accepted. The TY demuxer's demux_audio() processes the malformed packet, producing a negative size, which is passed to the Shorten decoder. The memcpy() call with a near-SIZE_MAX size writes beyond the bitstream buffer, corrupting heap memory.

5. Post-Exploitation: The attacker leverages the heap corruption to overwrite critical pointers and hijack execution flow, achieving arbitrary code execution in the context of the FFmpeg process. Depending on the service configuration, this could escalate to full server compromise, data exfiltration, or lateral movement within the network.

Scenario 2: Media Processing Pipeline Compromise

1. Reconnaissance: An attacker targets an organization that runs batch media processing jobs — for example, a broadcasting company, a data center operating media transcoding services, or a research institution processing video data.

2. Weaponization: The attacker crafts a malicious ffconcat file and embeds it in a media archive that is likely to be queued for processing, such as a video file submission to a media archive system.

3. Delivery: The attacker submits the archive via any organizational channel — email, file share, or an automated ingestion portal.

4. Execution: When the batch job processes the file with FFmpeg, the TY demuxer underflows, and the heap corruption is triggered. Because batch processing jobs often run with elevated privileges (e.g., service accounts with higher permissions), the attacker gains code execution with those privileges.

5. Post-Exploitation: The attacker maintains persistence by modifying the media processing pipeline to run additional commands, or uses the compromised host as a foothold to pivot into the network.

Impact Assessment

The CVSS score of 7.8 (High) reflects the significant impact of this vulnerability across confidentiality, integrity, and availability — all rated High per the vector. The attack vector is Local (AV:L), meaning the attacker must have local file access or the ability to trick a user into opening a crafted file, but the privileges required are None (PR:N), and only User Interaction (UI:R) is needed.

While the vulnerability is not directly remote-exploitable, the widespread deployment of FFmpeg in automated processing pipelines means that many real-world scenarios require minimal user interaction — a user uploading a file or an automated system processing an externally submitted file is often sufficient. In these configurations, the "local" vector rating does not adequately convey the practical risk.

Organizations most at risk include:

• Media platforms and streaming services that accept user-uploaded content
• Broadcasting corporations processing incoming media feeds
• Security camera systems that use FFmpeg for video processing
• Video surveillance and archiving systems running automated FFmpeg pipelines
• Any organization using wrapper libraries (e.g., Python's ffmpeg-python, Node.js fluent-ffmpeg) that invoke FFmpeg on untrusted input

Blast radius includes potential code execution, data exfiltration from compromised hosts, and lateral movement. The heap corruption mechanism may also cause denial-of-service via crashes, further expanding the availability impact.

Detection Guidance

Sigma Rule

title: Potential CVE-2026-65704 FFmpeg TY Demuxer Heap Corruption
id: 8f3c2d5a-7b4e-11ee-9c0d-00155d1b3a7a
status: experimental
description: Detects FFmpeg process crashes or abnormal memory behavior associated with processing TY-format files via concat demuxer
author: Valtersit Threat Intelligence
logsource:
  category: process_creation
  product: linux
detection:
  selection_ffmpeg:
    Image|endswith:
      - '/ffmpeg'
      - '/ffprobe'
  selection_flags:
    CommandLine|contains:
      - '-safe 0'
      - 'concat:'
  selection_abnormal_exit:
    ExitCode:
      - 11  # SIGSEGV
      - 139 # Shell exit for SIGSEGV
      - 6   # SIGABRT
      - 134 # Shell exit for SIGABRT
  condition: selection_ffmpeg and selection_flags and selection_abnormal_exit
  timeframe: 10m
level: high
fields:
  - CommandLine
  - Image
  - User
  - ParentImage
falsepositives:
  - Legitimate processing of malformed media files that crash FFmpeg
  - System maintenance scripts using -safe 0 flag
tags:
  - attack.t1203
  - cve.2026.65704

YARA Rule

rule ffmpeg_ty_concat_malicious
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects crafted ffconcat files targeting CVE-2026-65704 in FFmpeg TY demuxer"
        cve = "CVE-2026-65704"
        date = "2026-01-15"
    strings:
        $concat_marker = "ffconcat version 1.0"
        $ty_extension = ".ty"
        $ty_mimetype = "video/x-tivo"
        $shorten_magic = { 53 48 4E } // 'SHN'
        $concat_safe_flag = "-safe 0"
    condition:
        $concat_marker at 0 and
        $concat_safe_flag and
        ($ty_extension or $ty_mimetype) and
        (#shorten_magic > 1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Potential FFmpeg CVE-2026-65704 malicious file download"; flow:established,to_server; http.request_line; content:"GET"; http.http_uri; content:".ffconcat"; nocase; http.http_uri; content:".ty"; nocase; file.data; content:"SHN"; nocase; startswith; classtype:attempted-user; sid:9006570401; rev:1; metadata:created_at 2026-01-15, cve 2026-65704, signature_severity Major;)

Elastic Detection

sequence by host.name with maxspan=5m
  [process where event.type == "start" and process.name == "ffmpeg" and
   process.args contains "-safe" and process.args contains "0"]
  [process where event.type == "end" and process.name == "ffmpeg" and
   (process.exit_code == 139 or process.exit_code == 134)]

Splunk SPL Query

index=process sourcetype=process_logs
| where process_name IN ("ffmpeg", "ffprobe")
  AND (command_line LIKE "%-safe 0%" OR command_line LIKE "concat:%")
  AND (exit_code IN (139, 134, 11, 6))
| stats count by host, user, process_name, command_line, exit_code
| sort - _time

Wazuh OSSEC Rule

<rule id="657040" level="12">
  <decoded>ffmpeg</decoded>
  <match>Segmentation fault|Aborted|SIGSEGV|SIGABRT</match>
  <if_sid>657041</if_sid>
  <options>no_full_log</options>
  <description>FFmpeg crashed - possible exploitation of CVE-2026-65704 (TY demuxer heap corruption)</description>
  <group>cve_2026_65704,</group>
</rule>
<rule id="657041" level="6">
  <decoded>ffmpeg</decoded>
  <match>-safe 0</match>
  <description>FFmpeg invoked with -safe 0 flag allowing unsafe concat paths</description>
</rule>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations — If an upgrade is not immediately possible, implement the following:

   • Disable the use of the -safe 0 flag in all FFmpeg invocations. This restricts the concat demuxer to safe relative paths and mitigates the attack vector. Review all scripts, cron jobs, and application configurations that invoke FFmpeg and remove or modify any occurrence of this flag.
   • Refuse to accept or process .ffconcat files from untrusted sources when using FFmpeg versions at or below 8.1.2.
   • Isolate FFmpeg processes in a sandboxed environment using technologies like Docker, Firejail, or SELinux/AppArmor confinement. This limits the blast radius of a potential code execution.
   • Run FFmpeg under a low-privilege service account with no write access to system directories and minimal network permissions.

2. Patch/Upgrade Steps —

   • Monitor the FFmpeg official website (ffmpeg.org) and the ffmpeg-devel mailing list for an official release note addressing CVE-2026-65704.
   • When available, upgrade to the patched version: git pull and rebuild, or download the new release tarball from ffmpeg.org/releases/. The patch is claimed to exist per NVD but has not been independently confirmed; verify any release against the NVD description.
   • For distributions that package FFmpeg (Debian, Ubuntu, CentOS/RHEL, etc.), apply security backports as they become available in the distribution's security repositories: sudo apt update && sudo apt upgrade ffmpeg (Debian/Ubuntu) or sudo yum update ffmpeg (RHEL/CentOS).
   • After upgrading, verify the new version with ffmpeg -version and confirm it reports a version higher than 8.1.2.

3. Long-Term Hardening —

   • Implement strict file validation before passing media files to FFmpeg. Use non-Ffmpeg tools to validate file structure and refuse files that declare inconsistent container/stream metadata.
   • Add monitoring for FFmpeg process behavior as described in the Detection Guidance section. Deploy the Sigma, YARA, and Wazuh rules to identify exploitation attempts.
   • Establish an internal policy for handling untrusted media files, requiring that all such files pass through a dedicated, isolated processing service with appropriate security controls.
   • Stay subscribed to FFmpeg security advisories and the NVD feed to receive timely notifications about new vulnerabilities and patches.
   • Conduct a review of all FFmpeg integrations to identify any instance where the -safe 0 flag is used without a valid business requirement, and either remove it or document it as a residual risk escalation.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-65704
• FFmpeg Official Site: https://ffmpeg.org
• FFmpeg Security Mailing List: https://lists.ffmpeg.org/mailman/listinfo/ffmpeg-devel
• MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65704
• CWE-191 (Integer Underflow) Reference: https://cwe.mitre.org/data/definitions/191.html

As of the date of this report, no known active threat actor campaigns or exploit-in-the-wild evidence has been publicly documented for this CVE. The vulnerability is not listed on the CISA KEV (Known Exploited Vulnerabilities) catalog. Analyst monitoring is nonetheless recommended given the widespread use of FFmpeg in enterprise and consumer software, and the historical pattern of rapid weaponization of FFmpeg memory-corruption vulnerabilities once they become publicly documented.