Description

FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.9",
  "pubDate": "2026-09-13T22:17:00.433Z",
  "pubdate": "2026-09-13T22:17:00.433Z",
  "executiveSummary": "This vulnerability is an out-of-bounds read flaw identified within the FFmpeg multimedia framework, specifically impacting the MOV/MP4 container format parsing logic. The issue resides in the libavformat library, specifically within the mov_read_iacb function. The vulnerability is triggered by the processing of maliciously crafted media files containing insufficiently padded extradata, leading to an out-of-bounds memory access. Successful exploitation can result in the disclosure of sensitive memory content or cause a process crash, leading to a denial-of-service (DoS) condition. The vulnerability affects all versions of FFmpeg prior to 9.0. Attackers can exploit this by enticing a user or system to process a malformed MOV file, which may be delivered through various multimedia distribution channels. The risk is significant in applications where FFmpeg is used to process untrusted user-supplied content without robust sandboxing or input validation protocols.",
  "technicalDetails": "The vulnerability is located in the libavformat/mov.c source file within the FFmpeg codebase, specifically within the mov_read_iacb function responsible for parsing IACB (iACB) atom data in QuickTime MOV files. The root cause of this vulnerability is improper boundary checking during the handling of extradata associated with the media stream.\nDuring the parsing process, the function attempts to read data from the extradata buffer. However, the parser fails to ensure that the allocated buffer space is sufficiently padded to accommodate the read operations defined by the MOV format specifications. When a crafted file provides a specific extradata structure that does not meet the expected size requirements, the logic inside mov_read_iacb performs a read operation beyond the valid memory boundaries of the buffer.\nThe attack flow begins when an application utilizing FFmpeg opens a malicious MOV file. As the MOV demuxer iterates through the atoms of the file, it reaches the IACB atom. The parser allocates memory based on the size defined within the atom header but fails to validate or account for the necessary padding for subsequent read instructions. An attacker can manipulate the size field and content of the IACB atom to force the parser to perform an out-of-bounds read, accessing adjacent memory locations in the heap or stack.\nThe impact of this vulnerability depends on the memory layout and the specific environment in which FFmpeg is deployed. In a best-case scenario for the attacker, this read access could leak heap memory, potentially exposing pointers, encryption keys, or other sensitive runtime data that could be leveraged for further exploitation, such as bypassing ASLR (Address Space Layout Randomization). In most scenarios, accessing unmapped memory or triggering a violation will cause an immediate crash of the FFmpeg process, leading to a denial-of-service condition.\nThis vulnerability is reachable without authentication, provided an attacker can submit a file to the vulnerable target for processing. No special privileges are required for the initial execution, as the vulnerability is inherent to the parsing logic of the library itself. Because FFmpeg is widely integrated into web browsers, media players, and server-side transcoders, the attack surface is extensive, covering any service that automatically parses media uploads."
}