Description

FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.9",
  "pubDate": "2026-09-13T22:17:00.297Z",
  "pubdate": "2026-09-13T22:17:00.297Z",
  "executiveSummary": "This vulnerability is identified as an out-of-bounds read flaw within the libavcodec component of FFmpeg versions prior to 9.0.\nThe issue originates from improper handling of extradata allocation paths during the processing of WMA (Windows Media Audio) encoded files.\nThe vulnerability occurs because of missing required padding in the extradata buffer, which leads to memory access outside the intended bounds when the codec reads or writes this data.\nAn attacker could potentially exploit this by crafting a malicious WMA file designed to trigger the out-of-bounds read when processed by an application using the affected FFmpeg library.\nSuccessful exploitation may lead to an application crash (Denial of Service) or, under specific circumstances, the potential disclosure of sensitive information residing in memory adjacent to the improperly allocated buffer.\nThis vulnerability does not require authentication to exploit, as it can be triggered by providing a specifically crafted input file to the affected library.\nUsers and maintainers of systems utilizing FFmpeg are advised to update to version 9.0 or later to remediate this risk.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the memory allocation logic within libavcodec/wmaenc.c. When processing WMA extradata, the library fails to allocate sufficient padding bytes beyond the actual data buffer. This is a critical security oversight in memory management, as FFmpeg’s internal processing functions often rely on the assumption that buffers are properly padded to handle read operations safely.\nIn the context of the WMA encoder, the extradata is a critical structure that contains codec-specific configuration parameters. The vulnerability is specifically triggered within the allocation paths responsible for setting up this structure. Because the required padding is omitted during the initialization of the extradata buffer, subsequent operations—which assume standard buffer boundaries—inadvertently read beyond the allocated memory segment.\nThe attack flow involves the following sequence: 1) The attacker crafts a malicious WMA file containing specially manipulated extradata fields. 2) The victim application, utilizing an affected version of FFmpeg, invokes the WMA encoder/decoder interface to process the input. 3) During the processing of the extradata, the libavcodec/wmaenc.c component performs a read operation that traverses past the designated memory boundary due to the missing padding. 4) This triggers an out-of-bounds read, causing the process to either access adjacent, unauthorized memory or experience a segmentation fault.\nFrom an exploitation perspective, this is a memory-safety issue. While out-of-bounds reads are frequently considered less severe than out-of-bounds writes (which facilitate arbitrary code execution), they remain significant. In a worst-case scenario, the information disclosed via the read operation could potentially expose adjacent sensitive data, such as stack pointers or cryptographic material, which might aid an attacker in crafting a more complex exploit chain to bypass ASLR (Address Space Layout Randomization) or other defensive mitigations.\nThe vulnerability is restricted to libavcodec, specifically within the WMA handling logic, and is present in all versions of FFmpeg prior to the 9.0 release. No special privileges or authentication are required to trigger the crash; the exposure is inherent to any system or service that allows processing of untrusted media files through the vulnerable FFmpeg framework. The lack of proper boundary checks during the extradata allocation routine remains the primary failure point in the implementation of the wmaenc.c module."
}