Heap out-of-bounds write in the native PNG/APNG encoder when writing a crafted eXIf chunk (add_exif_profile_size() underestimates the sanitized IFD size). The eXIf-writing code does not exist in this
Heap out-of-bounds write in the native PNG/APNG encoder when writing a crafted eXIf chunk (add_exif_profile_size() underestimates the sanitized IFD size). The eXIf-writing code does not exist in this source: libavcodec/pngenc.c at n7.1.5 (and on the release/7.1 branch) has no EXIF/IFD handling at all; it was added in the 8.x series, which is why the CVE range reads "through 8.1.2". Upstream fix b506fafe cannot apply here because the code it patches is absent. Refs: - https://security-tracker.debian.org/tracker/CVE-2026-66040 - https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc details: | If this spec is ever bumped to a version whose pngenc.c writes eXIf chunks (8.1+), this entry MUST be re-evaluated and converted into a real PATCH_TYPE_UPSTREAM_PATCH entry.
ECHO-191b-44fe-7772
Primary source · Revision 1 · Withdrawn
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ECHO-191b-44fe-7772
ffmpeg
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 7:7.1.5-0+deb13u1+e5
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7:7.1.5-0+deb13u1+e5"
}
]
}
],
"package": {
"name": "ffmpeg",
"purl": "pkg:deb/echo/ffmpeg",
"ecosystem": "Echo"
},
"database_specific": {
"source": "https://advisory.echohq.com/osv/ECHO-191b-44fe-7772.json"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #19722 · Revision 1
- Added to Heist Feed
- Publisher date