CVE-2026-96611 is a medium severity (CVSS 6.9) signed integer overflow in FFmpeg before 9.0. When libavformat reads image dimensions from a crafted HEIF file, large values turn negative and later overflow, which bypasses size checks. Upgrade to FFmpeg 9.0 or a patched vendor build.
What's affected
The record says FFmpeg before 9.0 is affected. The weakness is CWE-190, integer overflow or wraparound. The FFmpeg commit and pull request the record cites sit behind a bot check, so I could not read them. Confirm the details against those links.
Per the record, the function mov_read_ispe in libavformat mov.c stores unsigned 32 bit width and height values from a crafted HEIF ispe box into signed fields with no bounds check, so values over the signed maximum become negative. In the image grid reading code, adding these values causes signed overflow, which is undefined behavior in C. On x86 it wraps to a small positive number and bypasses downstream validity checks.
The vector is local with high attack complexity and high confidentiality and integrity impact, so the real world risk depends on how your application feeds files to FFmpeg.
How to check if you're exposed
Check the FFmpeg version everywhere it is installed or bundled.
ffmpeg -version | head -1
ffprobe -version | head -1
Also look for FFmpeg libraries inside other products, such as media servers, thumbnailers, document converters and video platforms. Many ship their own copy.
On Linux distributions, fixes are frequently backported to older versions, so a version below 9.0 may already carry the fix. Check your vendor's security tracker for this CVE.
What to do now
- Upgrade to FFmpeg 9.0 or later, or install your distribution's patched package.
- Rebuild containers and applications that bundle FFmpeg libraries.
- Treat HEIF and HEIC files from untrusted users as hostile input. Process them in a sandbox with memory and time limits.
- If you do not need HEIF support, build FFmpeg without that demuxer path or reject the format before it reaches FFmpeg.
- Paste your lockfile or manifest into the free in-browser dependency scan to see whether the affected package is in your tree, then use reachability analysis to separate code paths you call from ones you never touch.
Why it matters
Image headers state sizes, and parsers use those sizes to decide how much memory to use. If the size arithmetic overflows, later checks compare against a wrong number and approve something they should reject. CWE-190 bugs often act as the first step in a memory safety chain rather than as an end in themselves.
The record scores it medium with a local vector and a high attack complexity. It does not mark exploitation and the CVE is not in CISA's catalog. For most teams the main step is to find the copies of FFmpeg they did not know they had, which a dependency inventory handles well.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is FFmpeg 9.0 required?
The record says versions before 9.0 are affected. Distribution packages may carry the fix on an older version number, so check your vendor.
Who is most exposed?
Services that decode HEIF files from untrusted users, such as upload processing and thumbnail generation.
Sources
Last reviewed: 18 October 2026.
