Vulnerability · Published Jul 24, 2026 · Assigned by VulnCheck

CVE-2026-66037FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()

Medium 6.5

In plain English

A medium-severity resource allocation without limits in FFmpeg from FFmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 71.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ffmpeg	no fix listed	DEBIAN-CVE-2026-66037
Debian:13	ffmpeg	no fix listed	DEBIAN-CVE-2026-66037
Debian:14	ffmpeg	7:9.0.2-1	DEBIAN-CVE-2026-66037
Ubuntu:26.10	ffmpeg	no fix listed	UBUNTU-CVE-2026-66037

Affected products (as reported)

Vendor	Product	Versions
FFmpeg	FFmpeg	0 – through 8.1.2

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu third-party-advisory