CVE-2026-66040

Name	CVE-2026-66040
Description	FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ffmpeg (PTS)	bookworm, bookworm (security)	7:5.1.9-0+deb12u1	vulnerable
	trixie (security), trixie	7:7.1.5-0+deb13u1	vulnerable
	forky	7:8.1.2-2	vulnerable
	sid	7:9.0.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ffmpeg	source	(unstable)	7:9.0.2-1

Notes

[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786
Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc (master)
Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5185caaeb8e2c05f7369cbedf0f616601bd82d5c (n9.0)