Security readout for executives and security teams
Plain-English summary
A specially crafted, dynamically resizing video can make FFmpeg write outside allocated memory when the floodfill filter runs with filter reinitialization disabled. This can crash media-processing services and may permit code execution, although that outcome depends on memory layout and process protections.
Executive priority
Treat as a high-priority media-processing vulnerability where untrusted uploads or feeds reach the affected configuration. Patch or remove the risky configuration promptly on exposed systems. Lower priority may be reasonable only after confirming the floodfill path is unreachable and documenting that evidence.
Technical view
In FFmpeg 3.4 through 8.1.2, vf_floodfill allocates its traversal stack from initial frame dimensions. With -reinit_filter 0, a later larger frame can cause filter_frame() to push neighboring points beyond that allocation, producing heap corruption. The issue is classified as CWE-131 and CWE-787 with CVSS 3.1 score 7.8.
Likely exposure
Exposure is most likely in applications, pipelines, or services that process untrusted video using the floodfill filter, permit frame-size changes, and disable filtergraph reinitialization. Deployments not invoking this filter configuration may not reach the vulnerable path. Confirm bundled FFmpeg versions because applications may embed it indirectly.
Exploitation context
The supplied CVSS vector describes local attack reachability with required user interaction, no privileges, and potentially high confidentiality, integrity, and availability impact. The source bundle does not establish active exploitation, and the CVE is not listed as KEV. Potential code execution is conditional, while process crashes and heap corruption are directly supported.
Researcher notes
The vulnerable allocation-to-use relationship spans config_input() and filter_frame(): initial dimensions size the traversal stack, but later dimensions govern neighbor insertion. Source reporting names versions 3.4 through 8.1.2 and provides a patch commit, but does not identify a clearly fixed release. Validate downstream backports and vendor packaging independently.
Mitigation direction
- Identify FFmpeg installations and embedded copies within media-processing products.
- Prioritize systems processing untrusted media with vf_floodfill and filter reinitialization disabled.
- Avoid the vulnerable filter configuration until remediation is confirmed operationally safe.
- Apply an FFmpeg release containing commit f186c50cf53aec20e9a29059cb22ca3f2d59201c after vendor confirmation.
- Use process isolation and least privilege to reduce consequences from malformed media.
Validation and detection
- Record each FFmpeg version, build provenance, and embedded library copy.
- Search application configurations for vf_floodfill and disabled filter reinitialization.
- Confirm whether workflows accept untrusted videos with changing frame dimensions.
- Verify the deployed build contains the cited patch commit or an equivalent vendor backport.
- Run defensive regression tests using controlled media in an isolated environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-131: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-65705 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9VulnCheckCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
7.3HighVector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Pull RequestCVE reference, VulnCheck · issue-tracking
- Patch CommitCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frameCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Calculation of Buffer Size
Incorrect Calculation of Buffer Size represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.