CVE-2026-66037

Executive Summary

CVE-2026-66037 is an uncontrolled resource consumption vulnerability in the FFmpeg IAMF (Immersive Audio Model and Formats) demuxer, affecting all versions through 8.1.2. An unauthenticated attacker can trigger a multi-gigabyte memory allocation from a trivially small (17-byte) crafted input file by manipulating the count_label field, which is amplified approximately 126 million times per input byte before validation. Successful exploitation exhausts process memory or triggers an OOM-kill during format probing, enabling a denial-of-service condition against any service that processes untrusted media files, including media servers, web applications, and automated processing pipelines.

Technical Analysis

The vulnerability resides in libavformat/iamf_parse.c within the mix_presentation_obu() function, which processes the Mix Presentation OBU (Open Bitstream Unit) of an IAMF stream. The flaw is a classic time-of-check/time-of-use (TOCTOU) ordering issue: the function calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled count_label value before validating that enough OBU data is actually available to support that count.

The IAMF demuxer parses ISO BMFF (MP4) or OBU-based streams. During format probing, when ff_iamf_parse_obu() processes the mix presentation OBU, it deserializes the count_label field (a variable-length unsigned integer) directly from the bitstream without comparison against a bounded read budget. The subsequent av_calloc() multiplies this count by the size of the language label struct (approximately 8–16 bytes depending on architecture and build flags), passing the result to the allocator. Since count_label is a 32-bit field (maximum 4,294,967,295 when little-endian encoded with variable-length coding), the product can reach tens or hundreds of gigabytes, exceeding the process address space on 32-bit systems and exhausting physical memory on 64-bit systems.

Crucially, the allocation occurs during probing — before the demuxer performs any significant parsing or validation of the remaining stream contents. The 17-byte file is sufficient because OBU headers are compact: a 1-byte OBU header plus a variable-length metadata indicating the payload type, followed by the count_label field encoded in the OBU payload. The attacker does not need to provide the actual language labels or any trailing data; the allocator is called immediately after reading the count.

The amplification factor of approximately 126 million bytes per input byte means a 100-byte file can request over 12 gigabytes of contiguous memory. On systems with memory overcommit enabled, the allocation succeeds virtually, but actual page faults during initialization of the zero-filled memory (or subsequent writes) will trigger the OOM-killer. Without overcommit, the allocation fails immediately, but repeated probing attempts (e.g., by a media server scanning many files) can still exhaust memory through fragmented allocation failures.

Exploitation Scenarios

Scenario 1: Media Server Denial of Service via API Endpoint

1. Reconnaissance: An attacker identifies a target media server (e.g., a video streaming platform, a media transcoding service, or an email gateway that processes attached media) exposing an upload endpoint or URL-based ingestion API. Shodan queries such as product:"FFmpeg" or http.title:"FFmpeg" reveal publicly accessible instances.
2. Weaponization: The attacker constructs a minimal IAMF OBU file. Using a hex editor or a Python script with bit-level operations, they craft:
   • OBU header (1 byte): header type = IAMF_MIX_PRESENTATION (type 4), obu_has_size_field = 1, obu_extension_flag = 0.
   • Size field (2+ bytes): encoded as LEB128, declaring the OBU payload size as sufficient to contain the count_label field (e.g., 4 bytes).
   • OBU payload (4 bytes): LEB128-encoded count_label set to 0xFFFFFFFF (4,294,967,295), representing a label count that would require ~34 GB of memory for the language label array.
   • Total file size: 7 bytes minimum; 17 bytes when including the ISO BMFF container wrapper (ftyp, mdat, etc.).
3. Execution: The attacker submits the file via the API (POST /media/upload or GET /transcode?url=...). The target service invokes FFmpeg's format probing (av_probe_input_format3() and avformat_open_input()), which triggers the IAMF demuxer's mix_presentation_obu().
4. Post-exploitation: The av_calloc(count_label, sizeof(...)) call requests ~34 GB. On a server with 32 GB RAM, the kernel OOM-killer terminates the FFmpeg process. A subsequent retry with multiple concurrent requests (1,000 requests/day at 17 bytes each = 17 KB total network traffic) causes sustained OOM-kill loops, degrading or fully denying service to legitimate media processing. On a 64-bit system with memory overcommit (vm.overcommit_memory=1), the virtual allocation succeeds, but the first touch of the zero-filled pages forces page-in, causing swap thrashing and CPU starvation across the host.

Scenario 2: Automated Pipeline Poisoning

1. Reconnaissance: The attacker identifies a CI/CD pipeline or batch processing system that automatically scans incoming media files (e.g., a security email gateway with attachment media preview, a content moderation pipeline, or a video indexing service).
2. Weaponization: Same 17-byte file as above, renamed to sample.mp4 with a manipulated IAMF track header to pass initial container validation.
3. Execution: The file is delivered (email attachment, S3 bucket upload, network share drop) and automatically fed to the processing pipeline.
4. Impact: Every worker node that probes the file crashes with OOM. The pipeline stalls, and if monitoring is insufficient, the worker death cascades, potentially corrupting job queues and requiring manual intervention. Multiple crafted files with varying count_label values (e.g., 1,000 files × 17 bytes) can persistently hang autoscaling groups that respawn workers.

Impact Assessment

CVSS Analysis (6.5 Medium): The vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H reflects: network attack surface (AV:N) with low complexity (AC:L); no privileges required (PR:N); but user interaction (UI:R) is required — an operator or automated system must invoke FFmpeg on the crafted file. The impact is purely on availability (A:H) with no confidentiality (C:N) or integrity (I:N) loss. The 6.5 score is moderate because single-file exploitation primarily crashes one process; however, the amplification ratio (126M bytes per input byte) makes volumetric denial-of-service trivial — an attacker can saturate any FFmpeg service with a few kilobytes of traffic.

Business Impact: Media processing services — video platforms, transcoding APIs, media proxy servers, and social media upload pipelines — are directly affected. For enterprise deployments, an attacker who can reach the file ingestion point (often unauthenticated in CDN or public upload scenarios) can:

• Terminate transcoding jobs, impacting service availability for legitimate users.
• Cause cascading OOM-kill failures in containerized environments (e.g., Kubernetes pods crashing and restart-looping).
• Inflate cloud computing costs if autoscalers provision additional workers in response to crash-triggered health-check failures.

Blast Radius: Any FFmpeg build ≤ 8.1.2 with IAMF demuxer support (enabled by default in most official builds since FFmpeg 5.1). The vulnerable code path executes during format probing, meaning the attack triggers without requiring the complete file to be a valid media container — the 17-byte minimum makes the attack extremely cheap. The EPSS score of 0.00282 (20.4th percentile) indicates low current exploitation likelihood, and CISA KEV does not list the vulnerability, suggesting no known in-the-wild campaigns.

Detection Guidance

Sigma Rule

title: FFmpeg IAMF Demuxer Excessive Memory Allocation - CVE-2026-66037
id: 9a3c45e2-9e17-4e8b-8c19-0e2b8f4d9a51
status: experimental
description: Detects FFmpeg processes allocating excessive memory, indicative of CVE-2026-66037 exploitation via crafted IAMF files.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-66037
author: Valtersit Threat Intelligence
date: 2026/06/15
logsource:
    category: process_creation
    product: linux
detection:
    selection_ffmpeg:
        Image|endswith: '/ffmpeg'
    selection_allocation:
        # Linux OOM-killer logs or memory allocation failures - use auditd or syslog Events
        # Placeholder for memory allocation event sources; adjust per environment
        Keywords|contains:
            - 'av_calloc'
            - 'OOM'
    condition: selection_ffmpeg and selection_allocation
level: high
falsepositives:
    - Legitimate large media files triggering high memory usage
    - Memory profiling tools
tags:
    - attack.t1499
    - cve.2026-66037

YARA Rule

rule CVE_2026_66037_IAMF_OOM {
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-06-15"
        description = "Detects crafted IAMF OBU files with oversized count_label field for CVE-2026-66037"
        reference = "CVE-2026-66037"
        score = 70
    strings:
        // ISO BMFF container: ftyp box (4-byte length + 'ftyp' + major_brand)
        $mp4_ftyp = { 00 00 00 ?? 66 74 79 70 }
        // IAMF mix presentation OBU header: OBU type 4 (0x40 for has_size_field)
        $obu_header_mix_present = { 40 }
        // LEB128 count_label with high values - check for 4-byte encodings
        // Look for size field indicating large payload
        $leb128_large = { FF FF FF 0F }
        $leb128_large_alt = { FF FF FF 0F 00 }
    condition:
        (uint32(0) == 0x00000000 or $mp4_ftyp) and
        any of ($obu_header_mix_present) and
        any of ($leb128_large*) and
        filesize < 1000
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-66037 FFmpeg IAMF Demuxer OOM Attempt - Crafted Small Media File"; flow:to_server,established; content:"Content-Type"; nocase; http_header; content:"video|2f|mp4"; nocase; http_header; content:"|46|TY"; depth:100; http.client_body; content:"|00 00 00 00|"; depth:10; http.client_body; asn1; sid:6603701; rev:1; reference:cve,2026-66037; classtype:attempted-dos; metadata:attack_target Client_Endpoint, created_at 2026_06_15, deployment Perimeter, signature_severity Major, tag DoS)

Note: The rule highlights HTTP upload requests containing the crafted small MP4 payload. Customize file-path or MIME detection if the service uses other transport methods.

Elastic Detection

// Elastic EQL rule detecting FFmpeg OOM-kill events correlated with small file processing
sequence by host.name, process.command_line with maxspan=5m
  [ process where process.name == "ffmpeg" and process.args contains "*.mp4" or process.args contains "*.obu" ]
  [ process where process.name == "oom-kill" and event.action == "process-killed" ]

For environments with auditd:

sequence by host.name, process.pid
  [ auditd where process.name == "ffmpeg" and auditd.data.syscall == "brk" and auditd.data.return == "-ENOMEM" ]
  [ file where file.size <= 100 ]

Splunk SPL Query

index=* sourcetype=linux_audit OR sourcetype=syslog
| search "ffmpeg" AND ("OOM" OR "Out of memory" OR "Killed process")
| table _time, host, process_name, pid
| join type=inner pid [ search index=* sourcetype=linux_secure
    | stats count by pid, user ]
| where count > 10
| eval description="Potential CVE-2026-66037 exploitation - FFmpeg OOM from IAMF file"

To detect file upload patterns:

index=web sourcetype=iis OR sourcetype=access_combined
| stats sum(bytes) as total_bytes, count as request_count by src_ip, uri_path
| where total_bytes < 1000 AND request_count > 100
| eval threat_score = 100 - (total_bytes * 0.01 / request_count)
| where threat_score > 95
| table src_ip, uri_path, request_count, total_bytes, threat_score

Wazuh OSSEC Rule

<group name="ffmpeg,">
  <rule id="660370" level="10">
    <decoded_as>syslog</decoded_as>
    <match>ffmpeg|av_calloc|OOM|out of memory</match>
    <regex>Killed process.*ffmpeg|Cannot allocate memory</regex>
    <description>FFmpeg IAMF demuxer excessive memory allocation (CVE-2026-66037) - process killed by OOM.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
  <rule id="660371" level="8" frequency="10" timeframe="60">
    <if_sid>660370</if_sid>
    <same_source_ip/>
    <description>Multiple FFmpeg OOM events from same source - potential targeted DoS exploitation.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source, NVD, claims a patch; not independently verified via vendor advisory or code repository commit confirmation).

1. Immediate Mitigations:

   • Restrict IAMF demuxer: If the IAMF demuxer is not required, disable it at build time or export FFMPEG_DEMUXERS="!iamf" in build environments. For runtime, consider a wrapper that pre-validates file size and rejects files < 1 KB in media ingest pipelines.
   • Limit process memory: Run FFmpeg under ulimit -v (e.g., 512 MB) or use systemd MemoryMax=1024M and MemorySwapMax=0 to prevent OOM-kill of the host kernel; the FFmpeg process will fail safely instead.
   • Apply application-layer sandboxing: Use seccomp or gVisor to restrict address space growth via setrlimit(RLIMIT_AS).

2. Patch/Upgrade Steps:

   • Upgrade to FFmpeg build containing commit 5d7112c (available in FFmpeg git master post-8.1.2). For distro packages, track backports: apt-get update && apt-get install ffmpeg (Debian/Ubuntu) or dnf update ffmpeg (Fedora/RHEL). Since the fix is in git master, newer release branches (e.g., 7.x, 6.x) may need cherry-picking; contact the distro maintainer for a security backport. Verify patch presence: ffmpeg -version or check the commit hash in git log if building from source. The NVD lists the fix in commit 5d7112c; validate the integrity of your package against this reference.
   • Verify the fix: after patching, feed a crafted IAMF file (e.g., 17-byte PoC) to ffmpeg -f lavfi -i /path/to/crafted and confirm it returns a parsing error (e.g., "Invalid data found when processing input") instead of allocating memory.

3. Long-Term Hardening:

   • Network perimeter: Deploy the Suricata rule above or a WAF regex blocking video/mp4 uploads under 100 bytes with suspicious OBU headers.
   • Runtime defense: Enable vm.overcommit_memory=2 and vm.overcommit_ratio tuning on media servers to prevent overcommit OOM kill cascades, forcing allocation failures instead of kernel OOM events.
   • Monitoring: Implement the Sigma/Elastic rules to alert on FFmpeg OOM kills; correlate with file upload sizes to detect amplification attacks. Set up automated quarantine for media files under 100 bytes hitting processing pipelines.
   • Vendor tracking: Subscribe to FFmpeg security advisories via the ffmpeg-devel-announce mailing list; note that patch confidence is 2/4, so independently verify the fix by examining the referenced commit in a local git clone (git fetch && git show 5d7112c) before deploying.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-66037
2. FFmpeg Git Repository: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/5d7112c (patch reference)
3. FFmpeg Official Site/Security: https://ffmpeg.org/security.html
4. CWE-770 Reference: https://cwe.mitre.org/data/definitions/770.html
5. CISA KEV (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-66037 is not present

Threat Actor Campaigns / In-the-Wild Exploitation: No known campaigns or exploit-in-the-wild evidence as of the report date. The EPSS score of 0.00282 indicates a 20th-percentile likelihood of exploitation within 30 days, meaning low active exploitation but not negligible in targeted attacks. CISA KEV has not added this CVE.