CVE-2026-64835

Name of the Vulnerable Software and Affected Versions FFmpeg versions 4.4 through 8.1.2

Description An out-of-bounds memory access issue exists in the ADX audio decoder within libavcodec/adxdec.c. An attacker can trigger out-of-bounds reads and writes by providing a specially crafted ADX or AAX audio file that includes a mid-stream channel layout change. This occurs when the adx decode frame() function re-parses the stream header upon receiving AV PKT DATA NEW EXTRADATA side data but fails to update the internal channel state, leading to the use of a stale channel count when accessing the prev[] state array.

Recommendations Update FFmpeg to a version later than 8.1.2. As a temporary mitigation, avoid processing untrusted ADX or AAX audio files.