FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in
    the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle
    file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has
    larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial
    allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and
    process crash with potential for code execution. (CVE-2026-66041)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3e109a0c85 advisory.

    Latest upstream bugfix release from 8.1 branch. Changes:
    https://code.ffmpeg.org/FFmpeg/FFmpeg/src/branch/release/8.1/Changelog .























Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21572-1 advisory.

    - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).
    - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754).
    - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758).
    - CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768).
    - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).
    - CVE-2026-66041: Heap Out-of-Bounds Write via vf_quirc Filter (bsc#1272767).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in     the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle     file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has     larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial     allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and     process crash with potential for code execution. (CVE-2026-66041)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464198	Echo: ffmpeg: security update to 7:7.1.5-0+deb13u1+e5	Tenable Cloud Security	Echo Local Security Checks	Local	high
464198	Echo: ffmpeg: security update to 7:7.1.5-0+deb13u1+e5	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
358433	Fedora 44 : ffmpeg (2026-3e109a0c85)	Nessus	Fedora Local Security Checks	Local	critical
335498	openSUSE 16: ffmpeg-7 / ffmpeg-7-libavcodec-devel / ffmpeg-7-libavdevice-devel / etc (openSUSE-SU-2026:21572-1)	Nessus	SuSE Local Security Checks	Local	high
329731	Linux Distros Unpatched Vulnerability : CVE-2026-66041	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-66041

high

Tenable Plugins

high

high

critical

high

high