Read the docs
TI-2026-47028 Aliases CVE-2026-66039GHSA-84qc-6h9r-4w33

FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File

Priority LOW 39CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00307 23rd percentileScored 2026-11-07
Fix Fixed Red Hat: 34 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FFmpegFFmpegup to 8.1.2—Patch availableCNA
  • FFmpeg VendorFFmpeg Affected up to 8.1.2 Fixed in — Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*up to 8.1.2VulnerableFFmpeg
  • cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* Versions up to 8.1.2 Vulnerable ·FFmpeg

Remediation

Red Hat 34 advisories

  • RHSA-2026:92452 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:92449 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:82921 Released 2026-10-14 · Red Hat rating Important
    Red Hat AI Base Images 3.2.5 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
Show 31 more Red Hat advisories
  • RHSA-2026:82415 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cpu)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:82371 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (spyre)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:82368 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cuda)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:82066 Released 2026-10-13 · Red Hat rating Important
    Red Hat AI Inference Model Optimization Tools 3.5.2 (CUDA)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/model-opt-cuda-rhel9
  • RHSA-2026:82061 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference Tech Preview 3.5.2 (Gaudi)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
  • RHSA-2026:82059 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (ROCm)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:81170 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:81161 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (CPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:81128 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (CPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:80860 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (Spyre)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:80856 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.5.3 (CUDA 13.0)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:80760 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (Spyre)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:80757 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (ROCm 7.0)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:80739 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:80740 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (ROCm 6.4)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:80735 Released 2026-10-12 · Red Hat rating Important
    Red Hat AI Base Images 3.2.4 (TPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:76042 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (CUDA)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:75660 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Spyre)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:75659 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (ROCm 7.14)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rocm-7.14-rhel9
  • RHSA-2026:75658 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (TPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:75657 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (CUDA 13.0)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:75655 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Rubin)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rubin-rhel9
  • RHSA-2026:75654 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Neuron)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:75652 Released 2026-10-05 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (CPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74771 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.5.2 (Gaudi)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:74089 Released 2026-09-30 · Red Hat rating Moderate
    RHEL AI 3.0 RPM runtime CVE fix - ffmpeg
    • Red Hat Enterprise Linux AI 3.0 for RHEL 9 ffmpeg-6.1.6-9.el9ai, ffmpeg-free-rhai-6.1.6-9.el9ai, ffmpeg-free-rhai-devel-6.1.6-9.el9ai +16
  • RHSA-2026:66381 Released 2026-09-10 · Red Hat rating Important
    RHEL AI 3.6 RPM runtime CVE fix - ffmpeg
    • Red Hat Enterprise Linux AI 3.6 for RHEL 9 ffmpeg-6.1.6-8.el9ai, ffmpeg-free-rhai-6.1.6-8.el9ai, ffmpeg-free-rhai-devel-6.1.6-8.el9ai +16
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:60336 Released 2026-08-26 · Red Hat rating Important
    RHEL AI 3.3 RPM runtime CVE fix - ffmpeg
    • Red Hat Enterprise Linux AI 3.3 for RHEL 9 ffmpeg-6.1.6-7.el9ai, ffmpeg-free-rhai-6.1.6-7.el9ai, ffmpeg-free-rhai-devel-6.1.6-7.el9ai +16
  • RHSA-2026:60334 Released 2026-08-26 · Red Hat rating Important
    RHEL AI 3.4 RPM runtime CVE fix - ffmpeg
    • Red Hat Enterprise Linux AI 3.4 for RHEL 9 ffmpeg-6.1.6-7.el9ai, ffmpeg-free-rhai-6.1.6-7.el9ai, ffmpeg-free-rhai-devel-6.1.6-7.el9ai +16
  • RHSA-2026:60335 Released 2026-08-26 · Red Hat rating Important
    RHEL AI 3.5 RPM runtime CVE fix - ffmpeg
    • Red Hat Enterprise Linux AI 3.5 for RHEL 9 ffmpeg-6.1.6-7.el9ai, ffmpeg-free-rhai-6.1.6-7.el9ai, ffmpeg-free-rhai-devel-6.1.6-7.el9ai +16

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference Server 3.5Fixed RHSA-2026:82059, RHSA-2026:82061, RHSA-2026:82066, RHSA-2026:82368, RHSA-2026:82371, RHSA-2026:82415
Red Hat Enterprise Linux AI 3.0 for RHEL 9Fixed RHSA-2026:74089
Red Hat Enterprise Linux AI 3.3 for RHEL 9Fixed RHSA-2026:60336
Red Hat Enterprise Linux AI 3.4 for RHEL 9Fixed RHSA-2026:60334
Red Hat Enterprise Linux AI 3.5Fixed RHSA-2026:92449, RHSA-2026:92452
Red Hat Enterprise Linux AI 3.5 for RHEL 9Fixed RHSA-2026:60335
Red Hat Enterprise Linux AI 3.6 for RHEL 9Fixed RHSA-2026:66381
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126
Red Hat OpenShift AI 3.2Fixed RHSA-2026:80735, RHSA-2026:80739, RHSA-2026:80740, RHSA-2026:80757, RHSA-2026:80760, RHSA-2026:81128, RHSA-2026:82921
Red Hat OpenShift AI 3.5Fixed RHSA-2026:74771, RHSA-2026:75652, RHSA-2026:75654, RHSA-2026:75655, RHSA-2026:75657, RHSA-2026:75658, RHSA-2026:75659, RHSA-2026:75660, RHSA-2026:76042, RHSA-2026:80856, RHSA-2026:80860, RHSA-2026:81161, RHSA-2026:81170
Not affected: 1 product
  • Red Hat OpenShift AI 2.25

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66039
  2. 2026-10-03 Alias added: GHSA-84qc-6h9r-4w33
  3. 2026-10-05 Fix available: RHSA-2026:75659 · Red Hat
  4. 2026-10-05 Fix available: RHSA-2026:75660 · Red Hat
  5. 2026-10-05 Fix available: RHSA-2026:75655 · Red Hat
  6. 2026-10-05 Fix available: RHSA-2026:75657 · Red Hat
  7. 2026-10-05 Fix available: RHSA-2026:75654 · Red Hat
  8. 2026-10-05 Fix available: RHSA-2026:75652 · Red Hat
  9. 2026-10-05 Fix available: RHSA-2026:75658 · Red Hat
  10. 2026-10-05 Affected versions changed · Red Hat
  11. 2026-10-06 Fix available: RHSA-2026:76042 · Red Hat
  12. 2026-10-06 Affected versions changed · Red Hat
  13. 2026-10-13 Fix available: RHSA-2026:82066 · Red Hat
  14. 2026-10-13 Fix available: RHSA-2026:80735 · Red Hat
  15. 2026-10-13 Fix available: RHSA-2026:80739 · Red Hat
  16. 2026-10-13 Fix available: RHSA-2026:80740 · Red Hat
  17. 2026-10-13 Fix available: RHSA-2026:80757 · Red Hat
  18. 2026-10-13 Fix available: RHSA-2026:80760 · Red Hat
  19. 2026-10-13 Fix available: RHSA-2026:80856 · Red Hat
  20. 2026-10-13 Fix available: RHSA-2026:80860 · Red Hat
  21. 2026-10-13 Fix available: RHSA-2026:81128 · Red Hat
  22. 2026-10-13 Fix available: RHSA-2026:81161 · Red Hat
  23. 2026-10-13 Fix available: RHSA-2026:81170 · Red Hat
  24. 2026-10-13 Fix available: RHSA-2026:82061 · Red Hat
  25. 2026-10-13 Fix available: RHSA-2026:82059 · Red Hat
  26. 2026-10-13 Fix available: Red Hat AI Inference Server 3.5, Red Hat OpenShift AI 3.2 · Red Hat
  27. 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
  28. 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
  29. 2026-10-14 Fix available: RHSA-2026:82371 · Red Hat
  30. 2026-10-14 Priority changed: MEDIUM → LOW
  31. 2026-10-15 Fix available: RHSA-2026:82921 · Red Hat
  32. 2026-10-16 Affected versions changed · Red Hat
  33. 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
  34. 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
  35. 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat

References

Patch 2

  • TI-2025-19015 FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c. CVSS 3.1HIGH 8.8
  • TI-2024-21238 FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column. CVSS 3.1HIGH 8.4
  • TI-2023-06050 Ffmpeg: null pointer dereference in ffmpeg hls parsing CVSS 3.1HIGH 7.5
  • TI-2023-28420 Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to… CVSS 3.1HIGH 8.0
  • TI-2023-27357 FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the… CVSS 3.1HIGH 8.0
  • TI-2023-27044 Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local… CVSS 3.1HIGH 8.0
See all 514 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences