CVE-2026-66039 | FFmpeg up to 8.1.2 MACE6 Audio Decoder mace_decode_frame bytes_per_packet integer overflow

July 24, 2026 Yanac

A vulnerability was found in FFmpeg up to 8.1.2. It has been declared as critical. This impacts the function mace_decode_frame of the component MACE6 Audio Decoder. Such manipulation of the argument bytes_per_packet leads to integer overflow.

This vulnerability is listed as CVE-2026-66039. The attack may be performed from remote. There is no available exploit.

A patch should be applied to remediate this issue.VulDB Recent EntriesRead More