CVE-2026-65706

Executive Summary

CVE-2026-65706 is a high-severity out-of-bounds write vulnerability affecting FFmpeg versions 3.0 through 8.1.2, specifically in the vf_swaprect video filter. The flaw is triggered when processing crafted NV12 video frames with odd width dimensions, causing heap memory corruption that can lead to process crashes or potentially arbitrary code execution. Affected systems include any deployment using FFmpeg's vf_swaprect filter—media servers, transcoding pipelines, video processing platforms, and desktop applications that ingest untrusted video input. With a CVSS score of 7.8 and low attack complexity, this vulnerability warrants immediate attention for organizations that process video from untrusted sources.

Technical Analysis

The vulnerability resides in the vf_swaprect filter implementation within FFmpeg's libavfilter module. The NVD description indicates the issue spans FFmpeg versions 3.0 through 8.1.2, making it a long-standing defect present across multiple major release branches.

Root Cause: The filter_frame() function in the vf_swaprect filter allocates a temporary row buffer sized according to plane 0's pixel format characteristics—specifically, a single-byte pixel step appropriate for the luma (Y) plane of the NV12 format. However, this same buffer is subsequently reused when processing all planes, including the chroma (UV) plane. NV12 format stores chroma as interleaved two-byte-per-sample data, meaning the UV plane's row width in bytes is double that of the luma plane for the same pixel dimensions.

Mechanism: When an NV12 frame with odd width dimensions (specifically referenced as 17x16 in the NVD description) is processed, the chroma plane requires a byte-per-row count that exceeds the buffer allocation. The resulting operation is described as an 18-byte memcpy being performed into a 17-byte heap allocation. This one-byte overflow, while small in magnitude, occurs on the heap and can corrupt adjacent heap metadata, freelist pointers, or neighboring object data depending on allocator behavior and heap layout.

The out-of-bounds write is a classic buffer-overflow pattern where a single buffer is allocated under one set of assumptions and then used under different constraints. The NV12 input format's dual-plane structure (separate Y plane, interleaved UV plane) combined with odd-width frames creates the specific conditions where the size mismatch manifests.

Attack Surface: The attack vector is local (AV:L per CVSS vector), requiring the attacker to supply a crafted video file to an application that processes it through the vf_swaprect filter. The overall CVSS vector indicates user interaction is required (UI:R), meaning a user must open or process the malicious video file. The vulnerability requires no special privileges to trigger (PR:N).

Exploitability Factors:

• Low attack complexity (AC:L)—no special conditions or race conditions needed
• No privileges required (PR:N)—the flaw is in the library, not in privilege checks
• The heap corruption from a 1-byte overwrite may be sufficient to cause a crash; escalating to code execution typically requires heap grooming and is highly dependent on the embedded FFmpeg build, allocator (glibc malloc, jemalloc, etc.), and surrounding memory layout

Exploitation Scenarios

Attack Chain for Crafted Media File Delivery:

1. Target Reconnaissance: The attacker identifies organizations that transcode or process user-submitted video—streaming platforms, social media services, video editing software, surveillance systems, media asset management platforms. The attacker probes the target's video ingestion pipeline by submitting benign test videos with unusual dimensions (odd-width NV12 format) to confirm the target uses FFmpeg with the vf_swaprect filter. Shodan and other internet scanning can identify exposed media-processing endpoints.

2. Weaponization: The attacker crafts a malicious video file. Using ffmpeg's own tooling, they generate an NV12-encoded video with 17x16 pixel dimensions—an odd width value that triggers the buffer size mismatch. A test frame is constructed, and the attacker verifies locally that the crafted file triggers heap corruption in their own FFmpeg build matching the target's version. Heap grooming may be employed by manipulating the state of the heap before triggering the overflow—allocating and freeing controlled objects of specific sizes to position sensitive heap metadata adjacent to the vulnerable buffer. The attacker may leverage the one-byte overflow to corrupt a pointer's least significant byte (allocator tcache/unsorted-bin attacks) to redirect subsequent writes toward controlled memory.

3. Payload/Execution: The malicious file is delivered to the target vector. Attack vectors include:

   • Uploading the file to a web service that transcodes submissions
   • Embedding the file in an email attachment opened by a user of desktop video-editing software
   • Placing the file on a network share processed by a media server
   • For applications that accept URLs, pointing the encoder at a crafted remote file

   When the victim application invokes the vf_swaprect filter on the crafted frame, the 18-byte memcpy overwrites heap memory. If successfully groomed, this leads to arbitrary write primitives that allow the attacker to overwrite a function pointer, GOT entry, or vtable, redirecting execution to attacker-controlled shellcode or ROP chain.

4. Post-Exploitation Impact: With code execution achieved in the context of the video-processing process, the attacker gains a foothold. Impact ranges from denial-of-service (process crash from unmitigated heap corruption) to full remote/host compromise depending on the process privileges. On a media server, this could mean lateral movement to backend networks; on an end-user workstation, it could mean credential theft, persistence, and data exfiltration. The CVSS confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H), reflecting the vulnerability's capacity to fully compromise the target process.

Impact Assessment

CVSS Breakdown: The vulnerability is rated High severity with a CVSS score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Key subscore implications:

• Attack Vector: Local (AV:L) — The crafted video must trigger the filter on the same system where FFmpeg runs
• Attack Complexity: Low (AC:L) — No specialized conditions required beyond supplying the crafted frame
• Privileges Required: None (PR:N) — The vulnerability triggers without authentication
• User Interaction: Required (UI:R) — Someone must process the malicious file
• Confidentiality/Integrity/Availability Impact: High (C:H/I:H/A:H) — Full impact potential if code execution is achieved

Business Impact:

• Media Streaming & Transcoding Services: A single crafted upload can crash transcoding workers or, worse, compromise the pipeline. In cloud environments, this could pivot to container escape paths or other internal services.
• Video Editing Software: Users processing untrusted media (downloaded videos, email attachments) on corporate workstations face full host compromise.
• Surveillance & Video Analytics: Systems processing camera feeds could be compromised via injected media files.
• Supply Chain: Any downstream product embedding FFmpeg with vf_swaprect inherits the vulnerability, expanding the blast radius exponentially.

EPSS Assessment: The EPSS score of 0.00133 places this at a 3.2% percentile of exploited CVEs, indicating a low current likelihood of exploitation. However, given the vulnerability's age span (versions 3.0 through 8.1.2) and the widespread use of FFmpeg, the risk can escalate quickly once proof-of-concept code circulates. The CISA KEV database does not currently list this CVE, meaning no confirmed exploitation in the wild has been reported to CISA.

Detection Guidance

Sigma Rule

title: FFmpeg vf_swaprect Out-of-Bounds Write Exploitation Attempt
id: 3f8f7c2d-9a4b-4e5c-8f1a-2b6c0d7e9a10
status: experimental
description: Detects FFmpeg processes crashing or exhibiting abnormal behavior when processing NV12 video frames with odd dimensions, indicative of CVE-2026-65706 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65706
author: Valtersit Threat Intelligence
date: 2026/01/01
tags:
    - attack.t1203
    - attack.t1211
    - cve.2026.65706
logsource:
    category: process_creation
    product: linux
detection:
    selection_ffmpeg:
        Image|endswith:
            - '/ffmpeg'
            - 'ffmpeg.exe'
        CommandLine|contains:
            - 'swaprect'
            - 'vf_swaprect'
    selection_crash:
        Image|endswith:
            - '/ffmpeg'
            - 'ffmpeg.exe'
        CommandLine|contains|all:
            - 'nv12'
            - '17x16'
    condition: selection_ffmpeg or selection_crash
level: high
falsepositives:
    - Legitimate use of vf_swaprect filter with unusual frame dimensions in testing environments

YARA Rule

rule CVE_2026_65706_FFMPEG_VF_SWAPRECT_OOB_WRITE
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects crafted video files targeting FFmpeg vf_swaprect out-of-bounds write CVE-2026-65706"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65706"
        cve = "CVE-2026-65706"
        score = 75

    strings:
        $nv12_tag = "NV12" ascii wide
        $swaprect_tag = "swaprect" ascii wide
        $ffmpeg_magic = "ffmpeg" ascii wide
        $avc1_tag = "avc1" ascii wide
        $odml_tag = "odml" ascii wide
        $width17_be = { 00 11 } // width 17 in big-endian 16-bit
        $width17_le = { 11 00 } // width 17 in little-endian 16-bit
        $height16 = { 10 00 }   // height 16

    condition:
        (uint32(0) == 0x464F524D) // 'FORM' RIFF header
        and 2 of ($ffmpeg_magic, $nv12_tag, $swaprect_tag, $avc1_tag, $odml_tag)
        and ($width17_be or $width17_le)
        and $height16
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65706 FFmpeg vf_swaprect OOB Write Exploitation - Crafted NV12 Media Transfer"; flow:established,to_server; content:"GET"; http_method; content:"video"; http_uri; nocase; content:"nv12"; http_uri; nocase; content:"swaprect"; http_uri; nocase; content:"17x16"; http_uri; nocase; classtype:attempted-admin; sid:2026000071; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-65706;)

Elastic Detection

// Detect FFmpeg processes started with vf_swaprect filter arguments
// potentially targeting the CVE-2026-65706 vulnerability
process where event.action == "exec" and process.name == "ffmpeg"
    and process.args : "*swaprect*"
    and process.args : "*nv12*"
    and process.args : ("*17x16*", "*odd*")

Splunk SPL Query

index=process sourcetype="WinEventLog:Security" OR sourcetype="linux_secure"
    process_name="ffmpeg.exe" OR process_name="ffmpeg"
    | regex CommandLine="(?i).*(swaprect|vf_swaprect).*"
    | regex CommandLine="(?i).*nv12.*"
    | stats count min(_time) as first_seen max(_time) as last_seen by host, user, CommandLine
    | where count >= 1
    | table host, user, CommandLine, count, first_seen, last_seen

Wazuh OSSEC Rule

<group name="ffmpeg,cve-2026-65706,">
    <rule id="380119" level="10">
        <if_sid>530</if_sid>
        <match>ffmpeg|avconv</match>
        <regex>swaprect</regex>
        <regex>nv12</regex>
        <description>FFmpeg vf_swaprect filter detected with NV12 format - potential CVE-2026-65706 exploitation vector</description>
        <group>local,media</group>
        <mitre>
            <id>T1203</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: A patched version is claimed to exist per NVD, though this is not independently confirmed (confidence 2/4). The claim indicates the fix will ship in an FFmpeg release after 8.1.2.

1. Immediate Mitigations (before patch is verified/applied):

   • Disable or remove the vf_swaprect filter from FFmpeg builds where it is not essential to the application's functionality. This can be achieved by recompiling FFmpeg with --disable-filters and selectively enabling only required filters, or by clearing swaprect from the enabled filter list.
   • Restrict FFmpeg processing to trusted video sources only. If the application accepts user uploads, apply strict pre-processing validation:
     • Reject any video frame with odd width dimensions in NV12 format
     • Re-encode or convert incoming video with strict dimension checks before passing to FFmpeg's filtergraph
   • Use sandboxing and process isolation for the FFmpeg processing components (containers, seccomp profiles, AppArmor/SELinux) to limit the blast radius of a heap overflow.
   • Monitor process logs for FFmpeg crashes involving heap corruption (glibc detected messages, segfaults in filter_frame).

2. Patch/Upgrade Steps:

   • Monitor FFmpeg release announcements and NVD page for the patched version. The fix should land in a version newer than 8.1.2.
   • When the patched version is released, upgrade as follows:
     • Debian/Ubuntu: sudo apt update && sudo apt upgrade ffmpeg
     • RHEL/CentOS: sudo yum update ffmpeg (from EPEL or RPM Fusion)
     • macOS (Homebrew): brew upgrade ffmpeg
     • Windows: Download the latest static build from the official FFmpeg builds site
   • If FFmpeg is statically linked into your application, rebuild the application against the patched FFmpeg source.
   • After patching, run a regression test against a corpus of NV12 files with odd width dimensions to confirm the fix, given the patch is not yet independently confirmed.

3. Long-Term Hardening:

   • Add negative test cases to your CI/CD pipeline covering odd-width NV12 frames through vf_swaprect to prevent regression.
   • Implement fuzzing of the FFmpeg filtergraph with a focus on format dimension edge cases (odd widths, small dimensions) using AFL++ or libFuzzer in your build pipeline.
   • Consider using memory-safe alternatives or wrappers when processing untrusted media, or use a hardened allocator (e.g., mimalloc, hardened glibc) when possible.
   • Establish a process for triaging and validating NVD patch claims before rollout, especially where patch sources are incomplete.
   • Continuously monitor threat intel channels and the EPSS score for this CVE; if the percentile rises above 50%, re-prioritize remediation and increase detection sensitivity.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-65706 — National Vulnerability Database entry providing official CVE metadata, CVSS score, and description.
2. FFmpeg Official Site: https://ffmpeg.org — Vendor site; monitor for release announcements containing the fix for this vulnerability.
3. FFmpeg Git Repository: https://git.ffmpeg.org/ffmpeg.git — Source repository where the patch will be committed; monitor commits to libavfilter/vf_swaprect.c.
4. CWE-131 Details: https://cwe.mitre.org/data/definitions/131.html — Common Weakness Enumeration page detailing the incorrect calculation of buffer size weakness class.
5. CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — No active entry for CVE-2026-65706 as of this report; check periodically for updates.

Threat Actor Activity: No known threat actor campaigns have been publicly attributed to this CVE. The CISA KEV database does not list it, and no exploit-in-the-wild evidence has been reported. The EPSS score of 0.00133 (3.2% percentile) corroborates the lack of observed exploitation. However, the vulnerability spans over five major FFmpeg release branches, making it a compelling target for a weaponized exploit. Security teams should treat this as a high-priority hardening item, especially in CVEs that process user-uploaded media at scale.