CVE-2026-65706

Publication date 23 July 2026

Last updated 28 August 2026

Ubuntu priority

Cvss 3 Severity Score

Description

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
ffmpeg	26.04 LTS resolute	Vulnerable
	24.04 LTS noble	Vulnerable
	22.04 LTS jammy	Vulnerable
	20.04 LTS focal	Vulnerable
	18.04 LTS bionic	Vulnerable
	16.04 LTS xenial	Not affected
libav	26.04 LTS resolute	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	14.04 LTS trusty	Needs evaluation

Notes

leosilva

CVE-2026-65706: xenial not-affected — vf_swaprect.c absent (introduced 3.0)

Severity score breakdown

CVSS version:

Base score 8.5 · High

Base metrics

Parameter	Value
Attack vector	Local
Attack complexity	Low
Attack requirements	None
Privileges required	None
User interaction	Passive
Vulnerable system - Confidentiality impact	High
Vulnerable system - Integrity impact	High
Vulnerable system - Availability impact	High
Subsequent system - Confidentiality impact	None
Subsequent system - Integrity impact	None
Subsequent system - Availability impact	None

Scores

Parameter	Value
Base score	8.5 · High
Base + Threat score	-
Base + Environmental score	-
Base + Threat + Environmental score	-

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Base score 7.8 · High