CVE-2026-96611

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0

Description A signed integer overflow exists in libavformat/mov.c. In the mov read ispe() function, uint32 t width and height values from a crafted HEIF ispe box are stored in signed int fields without bounds checking, which allows values exceeding INT MAX to be treated as negative. Subsequently, in the read image grid() function, the accumulation of these values leads to a signed integer overflow. On x86 architectures, this results in a wrap-around to a small positive value, enabling the bypass of downstream validity checks.

Recommendations Update to version 9.0 or later.