HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-66039 — FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflo...

·Source: NIST NVD

Updated:

Executive Summary

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_fra

Analysis

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution. CVSS Score: 8.8. Published: 2026-07-24T20:18:20.880.

Indicators of Compromise (1)

CVE (1)
CVE-2026-66039
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 24, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

BBVA acquires SocGen's 50% stake in brokerage joint venture Altura Markets

BBVA has reached an agreement with Société Générale (SG) to integrate Altura Markets into the BBVA Group by acquiring the 50 percent stake currently owned by the French bank, becoming the company's sole shareholder. The transaction is subject to the relevant regulatory approvals.

Finextra
MEDIUMVulnerabilityNEW

Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS

An unknown Chinese-threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most of which are fake Amazon Web Services (AWS) sign-in pages on a domain that also hosts the exploit toolkit. "

The Hacker News
MEDIUMVulnerabilityNEW

FCA streamlines transaction reporting obligations

Transaction reporting requirements become smarter, simpler and more proportionate under new rules from the FCA.

Finextra