CVE-2026-66041

Name of the Vulnerable Software and Affected Versions FFmpeg versions 7.0 through 8.1.2

Description A heap out-of-bounds write exists in the vf quirc filter. An attacker can corrupt heap memory by providing a crafted PGS/SUP subtitle file with mismatched frame dimensions, specifically where the second presentation has larger dimensions than the first. This causes the av image copy plane() function to copy data exceeding the initial allocation size into an undersized libquirc grayscale image buffer, leading to a process crash and potential arbitrary code execution.

Recommendations Update FFmpeg to the version containing commit 4da9812. As a temporary mitigation, avoid processing PGS/SUP subtitle files using the vf quirc filter.