CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2026-66040

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.

Score
8.7 high
Published
2026-07-24
Links
NVD · cve.org

Affected ports (3)

PortPackageVersionStatusMaintainer
multimedia/ffmpeg3ffmpeg33.0.2_1unaddressedkreinholz@gmail.com
multimedia/linux-rl9-ffmpeglinux-rl9-ffmpeg-libs7.1.5unaddressedemulation@FreeBSD.org
multimedia/ffmpeg4ffmpeg44.4.8_2possibly backportedmonwarez@mailoo.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>ffmpeg3</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>linux-rl9-ffmpeg-libs</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap
	out-of-bounds write vulnerability in the native PNG and APNG encoders
	that allows remote attackers to corrupt heap memory by supplying a
	crafted PNG image with a malicious eXIf chunk. Attackers can craft an
	eXIf chunk where multiple IFD entries reference the same large value
	payload, causing canonical serialization to expand the output far
	beyond the undersized allocation estimated by add_exif_profile_size(),
	resulting in png_write_chunk() writing tens of thousands of bytes past
	the buffer boundary, leading to deterministic heap corruption, process
	crash, and potentially arbitrary code execution.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-66040</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-66040</url>
    </references>
    <dates>
      <discovery>2026-07-24</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>