Security readout for executives and security teams
Plain-English summary
A crafted FFconcat input can corrupt memory when FFmpeg processes it with unsafe path handling enabled. Successful abuse requires a user or service to process attacker-controlled media, but impact could include crashes, data compromise, or code execution depending on the environment. The supplied evidence rates the issue high severity, not critical.
Executive priority
Prioritize rapid assessment and remediation for internet-facing upload services, shared media platforms, and automated transcoding pipelines. Patch promptly where untrusted input reaches FFmpeg with -safe 0. Other deployments should still inventory and update on an accelerated schedule because heap corruption carries confidentiality, integrity, and availability consequences.
Technical view
The TY demuxer can decrement a packet size below zero without validation. The Shorten decoder then passes that negative value to memcpy(); conversion to size_t produces an extremely large length, causing out-of-bounds reads and writes and heap corruption. The reported path involves crafted ffconcat input processed with the -safe 0 flag.
Likely exposure
Exposure is most likely in workstations, media pipelines, upload processors, and automation that use FFmpeg through 8.1.2, accept untrusted files, and permit ffconcat processing with -safe 0. Systems that do not process attacker-controlled inputs through this specific path have lower practical exposure. The affected-version metadata is imprecise, so inventory verification is necessary.
Exploitation context
The CVSS 3.1 score is 7.8 with local attack vector, low complexity, no privileges, and required user interaction. The supplied bundle says this CVE is not in KEV, and no cited evidence establishes active exploitation. Memory corruption may enable serious compromise, but reliable code execution is not demonstrated by the provided sources.
Researcher notes
The described chain crosses libavformat and libavcodec: TY demuxing produces a negative packet size, then Shorten decoding converts it to an oversized memcpy length. CWE-191 and CWE-787 apply. The bundle identifies a patch commit, but does not clearly name the first fixed release or demonstrate exploitation beyond memory corruption.
Mitigation direction
- Update to a vendor release containing commit de771bd52774a52d45b0e2c82e56995a1ef40df7 after compatibility testing.
- Disable or avoid ffconcat processing with -safe 0 where operationally possible.
- Reject untrusted ffconcat and related media inputs until patched.
- Sandbox FFmpeg workloads and minimize their filesystem, network, and service privileges.
- Check FFmpeg guidance for an officially supported fixed release.
Validation and detection
- Inventory FFmpeg versions across endpoints, containers, media services, and bundled applications.
- Identify workflows accepting untrusted media or ffconcat files.
- Search configurations and application code for ffconcat processing using -safe 0.
- Verify deployed binaries include the cited patch commit or a vendor-confirmed equivalent.
- Regression-test supported media workflows after updating or restricting unsafe processing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-191: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-65704 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9VulnCheckCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
7.3HighVector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Pull RequestCVE reference, VulnCheck · issue-tracking
- Patch CommitCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoderCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.