CVE-2026-66040

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.2

Description A heap out-of-bounds write exists in the native PNG and APNG encoders. A remote attacker can corrupt heap memory by providing a crafted PNG image containing a malicious eXIf chunk. By creating an eXIf chunk where multiple IFD (Image File Directory) entries reference the same large value payload, the canonical serialization expands the output beyond the allocation estimated by the add exif profile size() function. This causes the png write chunk() function to write data past the buffer boundary, leading to deterministic heap corruption, process crashes, and potentially arbitrary code execution.

Recommendations Update to the version containing commit b506faf.