CVE-2026-66041

Executive Summary

CVE-2026-66041 is a high-severity heap out-of-bounds write vulnerability in FFmpeg's vf_quirc filter, affecting versions 7.0 through 8.1.2. The flaw enables an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions, leading to heap corruption and process crash, with potential for arbitrary code execution. Any application that leverages FFmpeg for media processing — including media servers, transcoding platforms, video players, and automation pipelines — is exposed if it processes untrusted subtitle streams.

Technical Analysis

The vulnerability resides in the vf_quirc filter, which decodes QR codes from video frames. The filter integrates the libquirc library to extract and analyze QR code data from incoming frames. The attack vector exploits a mismatch between the dimensions of the first and second presentation segments within a PGS (Presentation Graphics Stream) subtitle file — the format commonly used in Blu-ray discs.

The PGS/SUP format consists of multiple presentation segments, each containing bitmap data for on-screen subtitle rendering. Each presentation contains its own frame dimensions. The vulnerable code path operates as follows:

1. When the first presentation is processed, the vf_quirc filter allocates an internal grayscale image buffer sized according to the first presentation's dimensions (width × height).
2. The filter calls av_image_copy_plane() to transfer pixel data from the decoded frame into this allocated libquirc buffer.
3. If the second presentation carries larger dimensions (e.g., a wider or taller subtitle bitmap), the copy operation writes second_width × second_height bytes into a buffer that was allocated for only first_width × first_height bytes.
4. Because av_image_copy_plane() performs a raw byte-by-byte copy without re-checking the destination allocation size, the excess data overflows the heap buffer boundary.

This is a classic CWE-787 (Out-of-bounds Write) flaw. The root cause is the absence of a reallocation or bounds-checking mechanism in the filter when frame dimensions change between consecutive presentations. The heap overflow corrupts adjacent heap metadata, which can be leveraged to achieve arbitrary write primitives or cause a denial-of-service via crash.

The attack surface includes any FFmpeg-based application that ingests PGS/SUP subtitle files — transcoding services (e.g., media servers like Jellyfin or custom pipelines), video editing tools, subtitle extraction utilities, and any web service that accepts user-uploaded media for processing. The bug is triggered purely by file content, requiring no special privileges beyond the ability to supply a malicious subtitle stream.

Exploitation Scenarios

Reconnaissance and Target Identification: An attacker identifies an organization that exposes an FFmpeg-based media processing service — e.g., a video transcoding API, a subtitle conversion tool, or a media server that accepts user uploads. Shodan queries such as http.component:"ffmpeg" or fingerprinting the media pipeline via file upload behavior help identify promising targets.

Weaponization and Trigger: The attacker crafts a malicious PGS/SUP file with two presentation segments:

1. The first presentation uses small dimensions (e.g., 320×180) to trigger the initial allocation of a small grayscale buffer.
2. The second presentation declares much larger dimensions (e.g., 1920×1080) and embeds bitmap data exceeding the initial allocation size.
3. The file is embedded in a container (e.g., MKV) or submitted directly as a SUP stream to the target service.

Payload Delivery and Execution: The attacker uploads the file through the service's API or web interface. The FFmpeg processing pipeline invokes the vf_quirc filter (either explicitly via a -vf quirc flag or automatically when a subtitle stream is detected and QR decoding is enabled). During processing, av_image_copy_plane() copies the oversized second presentation into the undersized heap buffer, triggering the overflow.

Post-Exploitation: A simple overflow corrupts heap metadata and crashes the process (denial of service). For code execution, the attacker tunes the payload to overwrite adjacent heap structures — commonly targeting the libavformat or libavcodec internal objects — to achieve a controlled write. Successfully crafting this enables arbitrary code execution in the context of the FFmpeg process. If the service runs with elevated privileges or processes multiple submissions, the attacker gains a foothold for lateral movement or data exfiltration.

Impact on Service Integrity: Even without full exploitation, repeated crashes can be used to disrupt media processing services, causing an HTTP 500 flood and degrading availability for legitimate users.

Impact Assessment

The CVSS v3.1 score of 8.8 (High) reflects a network-exploitable vector requiring only user interaction (submitting a crafted file). The vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a high confidentiality, integrity, and availability impact. The scope remains unchanged (S:U), isolating the impact to the FFmpeg process itself.

Affected systems include:

• Media servers (e.g., Jellyfin, Emby, custom transcode farms) that process Blu-ray ISO or MKV content with PGS subtitles.
• Video transcoding APIs that accept user-uploaded media files.
• Video editing and subtitle extraction tools built on FFmpeg libraries (libavfilter).
• Browser-based video players that rely on FFmpeg.js or WASM builds for client-side decoding.

Blast radius: The Heap OOB write can corrupt adjacent heap objects, potentially enabling code execution. The exact likelihood of RCE depends on heap layout and allocator behavior (glibc malloc vs. jemalloc). For services processing untrusted uploads at scale, an attacker can spray the heap with controlled allocations to increase the probability of a successful overwrite. If the FFmpeg process runs as root or a service account with broad filesystem access, the impact escalates to full host compromise.

CVSS subscores: C:H suggests full data confidentiality loss from the compromised process's memory space; I:H indicates the ability to modify or corrupt data; A:H reflects a trivial path to denial of service via process crash.

Detection Guidance

Sigma Rule

title: FFmpeg vf_quirc Heap Overflow Exploitation Attempt
id: 9f8c7e6d-5a4b-4c3d-9e8f-1a2b3c4d5e6f
status: experimental
description: Detects anomalous FFmpeg process behavior indicative of CVE-2026-66041 exploitation
date: 2026/01/01
tags:
    - attack.execution
    - attack.t1203
    - cve.2026-66041
logsource:
    category: process_creation
    product: linux
detection:
    selection_ffmpeg:
        Image|endswith: '/ffmpeg'
    selection_flags:
        CommandLine|contains|all:
            - 'vf'
            - 'quirc'
    selection_crash:
        CommandLine|contains:
            - 'Segmentation fault'
            - 'heap-corruption'
    condition: selection_ffmpeg and selection_flags and selection_crash
level: high

YARA Rule

rule CVE_2026_66041_PGS_Subtitle_Tampering {
    meta:
        author = "Valterit SOC"
        description = "Detects PGS/SUP subtitle files with mismatched presentation dimensions"
        cve = "CVE-2026-66041"
        date = "2026-01-01"
    strings:
        $pgs_magic = { 50 47 00 00 }  // "PG" header marker
        $pcs_segment = { 16 }          // PCS (Presentation Composition Segment) type
        $ods_segment = { 17 }          // ODS (Object Definition Segment) type
        $large_width = { 78 00 }       // width 120 (0x0078)
        $small_width = { 20 00 }       // width 32 (0x0020)
    condition:
        uint16(0) == 0x5047 and
        $pcs_segment and $ods_segment and
        ($large_width at 0 or $large_width at 100) and
        ($small_width at 0 or $small_width at 100)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-66041 - FFmpeg vf_quirc Heap Overflow Attempt"; flow:to_server,established; content:"Content-Type|3a| application/octet-stream"; http_header; content:"ffmpeg"; http.header_names; content:"quirc"; http.uri; fileext:"sup"; sid:2026041; rev:1; metadata:cve CVE-2026-66041, attack_target Client_Endpoint, deployment Perimeter;)

Elastic Detection

eql
sequence by process.entity_id
  [ process where process.name == "ffmpeg" and process.args : "*quirc*" ]
  [ file where event.action in ("open", "create") and file.extension in ("sup", "sub") ]
  [ process where process.name == "ffmpeg" and process.exit_code == 139 ]

Splunk SPL Query

index=main sourcetype=linux_audit OR sourcetype=process_execution
| where process_name="ffmpeg"
| search process_command_line="*quirc*"
| stats count by host, process_command_line, _time
| where count > 5
| eval alert_message="Multiple FFmpeg vf_quirc invocations detected - possible CVE-2026-66041 exploitation"

Wazuh OSSEC Rule

<group name="ffmpeg,">
    <rule id="838696" level="12">
        <decoded_as>json</decoded_as>
        <field name="process_name">ffmpeg</field>
        <field name="command_line">.*quirc.*</field>
        <description>FFmpeg vf_quirc filter execution detected - potential CVE-2026-66041</description>
        <group>cve-2026-66041,</group>
        <mitre>
            <id>T1203</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). The NVD references upstream commit 4da9812 as the fix; however, this has not been independently verified against the FFmpeg release branches. Treat this as provisional until an official FFmpeg release notes confirmation is published.

1. Immediate Mitigations (if patching is not immediately possible):

   • Do not enable the quirc filter in FFmpeg command lines unless absolutely required. Review pipelines for any -vf quirc or -af quirc flags and remove them.
   • If the filter must be used, sanitize input by re-muxing or re-encoding subtitle streams to a safe format (e.g., convert PGS to SRT text subtitles) before applying the filter, thereby stripping oversized bitmap data.
   • Deploy a content inspection layer that rejects SUP files whose presentation dimensions exceed a sane threshold (e.g., > 1920×1080) prior to FFmpeg processing.
   • Run FFmpeg processes under a least-privilege service account with restricted filesystem and network access to minimize post-exploitation impact.

2. Patch/Upgrade Steps:

   • Upgrade FFmpeg to version 8.1.3 or later once released (or pull the stable branch containing commit 4da9812).
   • For packagers and system administrators: monitor the FFmpeg release announcements at ffmpeg.org and apply the patched package via your system's package manager (e.g., apt upgrade ffmpeg on Debian/Ubuntu, yum update ffmpeg on RHEL/CentOS, or brew upgrade ffmpeg on macOS).
   • For applications embedding FFmpeg as a library, rebuild against the patched source and re-test the media pipeline before deployment. Confirm the commit hash 4da9812 is present in your source tree with git log --oneline | grep 4da9812.

3. Long-Term Hardening:

   • Integrate FFmpeg CVEs into your vulnerability scanning pipeline and subscribe to the FFmpeg-devel mailing list for pre-release security announcements.
   • Fuzz FFmpeg's subtitle demuxers (PGS, SUP, and related formats) within your CI/CD pipeline using AFL++ or libFuzzer to catch similar bounds issues before they ship.
   • Isolate FFmpeg-based services in containers with read-only root filesystems and network egress restrictions. Use seccomp profiles that block unexpected syscalls.
   • Log all FFmpeg invocations with full command-line arguments and correlate with file upload events for post-incident forensics.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-66041
2. FFmpeg Security Fix Commit: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/4da9812 (single source confirmation)
3. FFmpeg Official Release Page: https://ffmpeg.org/download.html
4. CWE-787 Out-of-bounds Write Reference: https://cwe.mitre.org/data/definitions/787.html
5. No known threat actor campaigns or exploit-in-the-wild evidence at the time of writing. EPSS score of 0.00423 (34.9th percentile) indicates low near-term exploitability prediction, but the public PoC reference raises the risk profile and warrants immediate attention.