Medium [CVE-2026-65705] Arbitrary code execution via out-of-bounds write in vf_floodfill video filter

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0.

When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.

A flaw was found in FFmpeg. An attacker could exploit this by providing a malicious video stream, which, when processed with filtergraph reinitialization disabled, causes heap memory corruption.

This can lead to a denial of service due to a process crash, and in some cases, may enable arbitrary code execution. Red Hat Enterprise Linux has multiple layers of heap protection.

NX/DEP (Non-Executable Memory) prevents code execution from heap, thus mitigating the code execution part of the exploit. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).

Red Hat does not currently list a fixing RHSA for this CVE.