CVE-2026-65705

Executive Summary

CVE-2026-65705 is a high-severity (CVSS 7.8) out-of-bounds write vulnerability in FFmpeg's vf_floodfill video filter, affecting versions 3.4 through 8.1.2. The flaw permits heap corruption when a video stream dynamically changes resolution while the filtergraph reinitialization is disabled (-reinit_filter 0), potentially allowing an attacker to escalate to arbitrary code execution. Any application or service that processes untrusted video input through FFmpeg with the floodfill filter enabled is at risk, particularly media servers, video processing pipelines, and desktop applications using the FFmpeg libraries.

Technical Analysis

The vf_floodfill filter implements a classic two-pass flood-fill algorithm for identifying contiguous regions of similar color in video frames. At the heart of the vulnerability is the interaction between the filter's config_input() callback and the per-frame processing performed in filter_frame().

Root Cause — Stack Allocation Based on Initial Frame Dimensions

When the filter is initialized, config_input() allocates a traversal stack (a dynamically-sized array used to manage the flood-fill frontier) based on the dimensions of the first frame processed. This allocation is performed once and assumed to be valid for the lifetime of the filter instance:

// Pseudocode illustrating the vulnerable pattern
static int config_input(AVFilterLink *inlink)
{
    FloodFillContext *s = inlink->dst->priv;
    s->stack_size = inlink->w * inlink->h;  // Allocated from initial frame
    s->stack = av_malloc(s->stack_size * sizeof(Point));
    // No reallocation logic exists for subsequent frames
    return 0;
}

The vulnerability is triggered by a format change in the input stream. FFmpeg supports dynamic resolution changes in video streams through its -reinit_filter mechanism, which re-initializes filter contexts when frame parameters change. However, when the filtergraph is invoked with -reinit_filter 0, this re-initialization is disabled, and the filter instance retains the stack pointer and stack_size from the original configuration.

Vulnerability Mechanism — Out-of-Bounds Write

When a subsequent frame arrives with dimensions larger than those used during config_input(), the filter_frame() function performs the flood-fill operation using the current frame's width and height for boundary calculations:

// Vulnerable write path
static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
{
    // Uses frame->width/height for flood-fill bounds
    int w = frame->width;
    int h = frame->height;
    
    // Pushes neighbors onto stack with indices based on w/h
    // Stack was allocated for smaller initial dimensions (inlink->w * inlink->h)
    // If w*h > s->stack_size, writes go beyond allocated buffer
    while (stack_top > 0) {
        Point p = stack[--stack_top];
        // ... color comparison logic ...
        if (p.x > 0) stack[stack_top++] = (Point){p.x-1, p.y}; // OOB write
        if (p.x < w-1) stack[stack_top++] = (Point){p.x+1, p.y};
        if (p.y > 0) stack[stack_top++] = (Point){p.x, p.y-1};
        if (p.y < h-1) stack[stack_top++] = (Point){p.x, p.y+1};
    }
}

Because the stack's capacity was computed from the initial frame's w * h (where h includes only the visible frame region), a larger subsequent frame causes the stack push operations to exceed the allocation boundary. The overflow is a classic heap buffer overflow writing 8-byte structures (two int coordinates per Point struct) past the end of the allocated region.

Attack Surface

The attack vector requires:

1. An application using FFmpeg with the floodfill filter enabled
2. The filtergraph must be configured with -reinit_filter 0 (or equivalent API parameter)
3. Attacker-controlled video input that contains a resolution change mid-stream

This is a local attack vector (AV:L) requiring user interaction (UI:R), meaning an attacker must convince a user to open or process a crafted video file. The vulnerability is not remotely exploitable without a media-processing daemon that ingests network-delivered video.

Memory Corruption Severity

The overflow writes contiguous 8-byte structures past the heap chunk boundary. The extent of the corruption depends on the size differential between the initial and subsequent frames. A frame with dimensions 10x larger than the initial frame can overflow the stack by up to 90% of the initial allocation size, potentially corrupting adjacent heap metadata, other filter contexts, or application data structures.

Exploitation Scenarios

Attack Chain — Targeted Code Execution via Crafted Media File

Step 1: Reconnaissance and Target Identification

An attacker identifies applications that use FFmpeg's floodfill filter. Common targets include:

• Video processing SaaS platforms that allow user-uploaded content
• Desktop video editors (Kdenlive, Shotcut, OpenShot) that expose floodfill as a filter
• Media streaming servers using FFmpeg for transcoding pipelines
• Security camera DVR/NVR systems that apply floodfill for motion detection preprocessing

The attacker verifies application behavior by checking:

• Application version strings (e.g., ffmpeg -version output exposed in debug endpoints)
• Error messages that leak FFmpeg version information
• Timestamps in generated output files via EXIF/metadata analysis

Step 2: Malicious Video Construction

The attacker crafts a video file with two distinct segments:

Segment 1: 1920x1080, 30 seconds, normal content (initializes filter with 2M-pixel stack)
Segment 2: 3840x2160, 30 seconds, high-contrast content (triggers 4x overflow)

The video is encoded with:

• H.264 or H.265 codec supporting resolution change mid-stream (via sps/pps NAL units in Annex B format)
• A color palette in Segment 2 designed to maximize flood-fill stack depth (large contiguous regions of similar color)
• Container: MKV or MP4 (both support resolution changes via track parameter changes)

Step 3: Delivery and Trigger

The attacker delivers the video via:

• Malicious email attachment
• Upload to a video processing web application
• Social engineering via media-sharing platforms

When the target application processes the video, FFmpeg's demuxer detects the resolution change, and filter_frame() in the vf_floodfill filter processes the larger frame without reallocating the stack, triggering the heap overflow.

Step 4: Heap Primitive and Code Execution

The attacker structures the heap layout to maximize exploitation success:

• Heap grooming: The video is constructed so that the floodfill filter's stack allocation is adjacent to a heap chunk containing a function pointer (e.g., AVCodecContext callbacks, AVFilterLink method pointers, or the target application's vtable entries)
• Overflow payload: The overflow writes Point structures that overwrite adjacent heap data with controlled integers (x, y coordinates), which the attacker sets to values corresponding to a stack pivot or code address
• Execution: When the corrupted function pointer is invoked (e.g., during the next filter frame processing), control transfers to attacker-controlled shellcode or a ROP chain

Given modern heap hardening (ASLR, DEP), the attacker may instead leverage the overflow for:

• Information disclosure: Overwriting allocator metadata to leak heap addresses
• Privilege escalation: If the application runs with elevated privileges, local code execution can be escalated
• Persistence: If the corrupted memory affects the target application's file-write logic, the attacker can implant backdoor code in output files

Post-Exploitation

Successful exploitation grants the attacker:

• Code execution with the privileges of the media-processing application
• Ability to pivot to other network-accessible systems
• Access to processed media data, potentially including sensitive user content
• Potential for lateral movement in enterprise video-surveillance or media infrastructure

Impact Assessment

CVSS Breakdown: 7.8 High

Business Impact

• High: Any organization operating video processing infrastructure is directly exposed. The flaw enables both denial-of-service (crash via minor malformed input) and potential code execution (via heap grooming).
• Reputational risk: Media processing platforms must disclose if user-uploaded content could trigger this flaw, potentially enabling cross-tenant attacks.
• Compliance: For organizations handling video evidence (law enforcement, healthcare, financial services), a compromise of media integrity is a reportable incident under most breach disclosure frameworks.
• Blast radius: FFmpeg's ubiquity means this affects millions of installations. The 4.8-year version range (3.4 through 8.1.2) indicates long-standing exposure across distributions, embedded devices, and application bundles.

Detection Guidance

Sigma Rule

title: FFmpeg CVE-2026-65705 Heap Overflow via vf_floodfill
id: 9f4c5a2b-6d3e-4f8a-b7c1-2e5d9a4b8c3f
status: experimental
description: Detects FFmpeg crashes or abnormal behavior associated with the vf_floodfill out-of-bounds write vulnerability (CVE-2026-65705)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65705
author: Valters IT Security
date: 2026/01/15
tags:
    - attack.execution
    - cve.2026.65705
    - cwe.131
logsource:
    category: process_creation
    product: linux
detection:
    selection_ffmpeg_launch:
        Image|endswith:
            - '/ffmpeg'
            - '/avconv'
        CommandLine|contains:
            - 'floodfill'
            - 'vf_floodfill'
    selection_reinit_disabled:
        CommandLine|contains:
            - '-reinit_filter 0'
    selection_crash_signal:
        - Signal: 'SIGSEGV'
        - ExitCode: '139'
    condition: selection_ffmpeg_launch and selection_reinit_disabled or selection_crash_signal
    timeframe: 5m
level: high
falsepositives:
    - Legitimate use of floodfill filter with reinit disabled on stable-resolution streams
    - FFmpeg crashes from unrelated memory corruption

YARA Rule

rule CVE_2026_65705_FFmpeg_FloodFill_Overflow
{
    meta:
        author = "Valters IT Security"
        description = "Detects FFmpeg binaries vulnerable to CVE-2026-65705 (vf_floodfill heap overflow)"
        cve = "CVE-2026-65705"
        date = "2026-01-15"
        severity = "high"
    strings:
        // Detect floodfill filter registration
        $floodfill_name = "floodfill" ascii wide
        $floodfill_init = "config_input" ascii
        $floodfill_frame = "filter_frame" ascii
        
        // Detect reinit filter option handling (weak indicator)
        $reinit_option = "reinit_filter" ascii wide
        $stack_malloc = "av_malloc" ascii
    
        // Version signatures vulnerable range (3.4-8.1.2)
        $ver_3 = "FFmpeg version 3." ascii
        $ver_4 = "FFmpeg version 4." ascii
        $ver_5 = "FFmpeg version 5." ascii
        $ver_6 = "FFmpeg version 6." ascii
        $ver_7 = "FFmpeg version 7." ascii
        $ver_8 = "FFmpeg version 8." ascii
    
    condition:
        // Binary contains floodfill filter identification
        $floodfill_name and
        // Combined with version strings in range 3.4 - 8.1.2
        (any of ($ver_*)) and
        // Engine functions present
        ($floodfill_init or $floodfill_frame) and
        // 8.1.2 and earlier would appear here; above pattern matches
        uint16(0) == 0x457f  // ELF magic
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65705 FFmpeg vf_floodfill Heap Overflow Attempt";
    flow:established,to_server;
    content:"floodfill"; nocase;
    content:"reinit_filter"; nocase;
    content:"0"; within:5;
    content:"Content-Type|3a 20|video/"; nocase;
    pcre:"/(multipart\/form-data|application\/octet-stream)/i";
    sid:2026657050001; rev:1;
    classtype:attempted-admin;
    reference:cve,2026-65705;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65705;
    metadata:created_at 2026_01_15, updated_at 2026_01_15, mitre_tactic_id T1203;
    priority:1;) 
    
alert http any any -> any any (msg:"CVE-2026-65705 FFmpeg FloodFill Media Processing Request";
    flow:established,to_server;
    content:"POST"; http_method;
    content:"video/mp4|0d 0a|"; http_header;
    content:"floodfill"; nocase;
    sid:2026657050002; rev:1;
    classtype:attempted-admin;
    reference:cve,2026-65705;
    metadata:created_at 2026_01_15, updated_at 2026_01_15;
    priority:2;)

Elastic Detection

// Detect FFmpeg crash patterns associated with CVE-2026-65705
// Run on process events index
any where process.executable == "*ffmpeg*" and 
  (
    // Crashes via SIGSEGV
    process.parent.name == "ffmpeg" and 
    signal.name == "SIGSEGV" and
    process.args contains "floodfill"
  ) or
  (
    // Abnormal exit codes from FFmpeg processes
    event.action == "process_terminated" and
    process.exit_code == 139 and
    process.command_line contains "floodfill"
  ) or
  (
    // Heap corruption detections in logs
    event.category == "process" and
    message contains "heap corruption" and
    process.args contains "floodfill"
  )

Splunk SPL Query

index=windows OR index=linux sourcetype=WinEventLog:Security OR sourcetype=linux_secure
| where match(process_name, "(?i)ffmpeg|avconv")
| search process_commandline="*floodfill*" OR process_commandline="*-reinit_filter 0*"
| eval cve_vuln=if(match(process_commandline, "floodfill.*reinit_filter 0"), "SUSPICIOUS", "MONITOR")
| stats count by host, user, process_commandline, cve_vuln
| where count > 3
| outputlookup cve_2026_65705_indicators.csv

// Crash detection query
index=* (process_termination OR process_exit)
| where exit_code=139 AND (process_name="ffmpeg" OR process_name="avconv")
| stats values(command_line) as cmd by host, source_ip, process_name
| where match(cmd, "floodfill")
| table host, source_ip, process_name, cmd, _time

Wazuh OSSEC Rule

<group name="cve_2026_65705_ffmpeg,">
  <!-- Rule 1: FFmpeg floodfill invocation with suspicious flags -->
  <rule id="334813" level="12">
    <decoded>
      <program_name>ffmpeg|avconv</program_name>
    </decoded>
    <match>floodfill|vf_floodfill</match>
    <match>-reinit_filter 0|-reinit_filter=0</match>
    <description>CVE-2026-65705: FFmpeg floodfill filter used with reinit_filter disabled (heap overflow risk)</description>
    <group>cve_2026_65705,</group>
    <mitre>
      <id>T1203</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <!-- Rule 2: FFmpeg crash with floodfill filter (SIGSEGV) -->
  <rule id="334814" level="14">
    <decoded>
      <program_name>ffmpeg|avconv</program_name>
    </decoded>
    <match>SIGSEGV|segmentation fault|heap corruption</match>
    <regex>floodfill|vf_floodfill</regex>
    <description>CVE-2026-65705: Possible FFmpeg heap overflow exploitation attempt - crash in floodfill filter</description>
    <group>cve_2026_65705,attack.kill_chain.execution,</group>
    <mitre>
      <id>T1203</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — NVD references a fix, but this has not been independently confirmed. Security teams should validate patch availability from their distribution vendor before deployment.

1. Immediate Mitigations

• Restrict filter usage: Disable the floodfill filter in applications unless strictly required for business operations. This can be done by:
  • Removing or renaming the libavfilter/vf_floodfill.c source file and rebuilding
  • Using a custom FFmpeg build with the filter excluded (--disable-filter=floodfill)
  • Implementing an application-level allowlist that rejects filtergraph specifications containing floodfill
• Re-enable filter reinitialization: Ensure -reinit_filter 1 (the default) is explicitly set in all FFmpeg invocations. This mitigates the vulnerability by forcing reallocation of the traversal stack when frame dimensions change, making the overflow impossible.
• Apply resource limits: Use ulimit -v (virtual memory) to constrain the heap increase available to FFmpeg processes, limiting the practicality of heap-grooming exploitation.
• Sandbox FFmpeg processes: Run FFmpeg in a container or seccomp-constrained sandbox to limit the impact of code execution.

2. Patch/Upgrade Steps

• Always obtain patches from official vendors. Monitor FFmpeg releases at https://ffmpeg.org/download.html and your OS package repository.
• Upgrade to the latest stable release (8.1.3 or later if available at your distribution). The NVD claims a fix; verify the fix tag in the FFmpeg git repository (git log --oneline -- libavfilter/vf_floodfill.c).
• Distribution-specific guidance:
  • Debian/Ubuntu: sudo apt update && sudo apt upgrade ffmpeg
  • RedHat/CentOS/Fedora: sudo dnf update ffmpeg or use RPMFusion repository
  • Windows: Update from BtbN builds or your software vendor's distribution
  • macOS: brew upgrade ffmpeg (if using Homebrew)
  • Docker: Rebuild base images with docker pull to fetch patched FFmpeg layers
• For statically-linked applications: Re-link and rebuild against patched FFmpeg libraries. Check your application vendor for updated builds.

3. Long-Term Hardening

• Coordinate with FFmpeg project: Monitor the FFmpeg-CVE mailing list and security advisories for CVE-2026-65705 disclosure details.
• Implement file validation: Before FFmpeg processes untrusted video, validate that the file's resolution is consistent throughout (e.g., using ffprobe or a custom parser checking SPS/PPS parameters).
• Enable filtergraph sandboxing: Use FFmpeg's -sandbox option (where available) to restrict filter access to only what the application requires. Avoid granting floodfill in untrusted filtergraph inputs.
• Adopt defensive coding in any custom FFmpeg wrapper: validate inlink->w/inlink->h against allocated stack size before calling config_input or processing frames.
• Regular security review: Incorporate FFmpeg into the vulnerability scanning cadence—the 4.8-year affected range indicates broad exposure.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-65705 CVE-2026-65705: FFmpeg 3.4 - 8.1.2 vf_floodfill out-of-bounds write via filter_frame().

2. FFmpeg Official Site: https://ffmpeg.org/download.html Official FFmpeg download page listing stable releases, patch history, and security advisories.

3. FFmpeg Git Repository: https://git.ffmpeg.org/ffmpeg.git Source code repository containing the libavfilter/vf_floodfill.c file. Check for commits referencing CVE-2026-65705 or resolution/overflow fixes.

4. CWE-131 Reference: https://cwe.mitre.org/data/definitions/131.html MITRE CWE database entry for "Incorrect Calculation of Buffer Size," the root CWE for this vulnerability.

5. EPSS Data (FIRST.org): https://www.first.org/epss/ EPSS score for CVE-2026-65705: 0.00133 (3.2% percentile), indicating low immediate exploitation likelihood in the wild.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of this writing, CISA KEV does not list CVE-2026-65705, and there are no publicly documented exploit campaigns targeting this vulnerability. The EPSS score (3.2% percentile) suggests current exploitation activity is minimal; however, the vulnerability class (heap overflow in media parser exposed to untrusted input) historically attracts significant research attention, and proof-of-concept publication is anticipated. Security teams are advised to prioritize patch deployment given the ease of triggering the crash condition and the potential for weaponization.