CVE-2026-66037

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.2

Description The IAMF demuxer contains an issue that allows an unauthenticated attacker to cause multi-gigabyte memory allocation using a small 17-byte input file. This occurs because the mix presentation obu() function in libavformat/iamf parse.c calls av calloc() using a crafted count label field before validating the available OBU (OpenGL Binary Object) data. This leads to an allocation amplification of approximately 126 million bytes per input byte, which can exhaust process memory or trigger an OOM-kill (Out-Of-Memory killer, a kernel process that terminates processes to free memory) during format probing.

Recommendations Update to the version containing commit 5d7112c. As a temporary workaround, restrict the use of the IAMF demuxer to process untrusted files.