ANT-2026-4YJK1P9J · ffmpeg/ffmpeg

heap-buffer-overflow high

Severity Claude high · Security research firm high · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-4YJK1P9J: Heap-buffer-overflow in dhav.c:286

While opening a DHAV container, dhav_read_header() calls get_duration(), which allocates a 1 MiB scan buffer (dhav.c:264) and then reads a 4-byte value at an offset that lands 16 bytes past the end of that buffer (dhav.c:286). The offset appears to be derived from attacker-controlled file contents and is not bounds-checked against the allocated buffer size. An attacker who can supply a DHAV file to any FFmpeg-based pipeline can trigger this out-of-bounds read, leading to a crash or potential disclosure of adjacent heap memory.

Target

Project: ffmpeg
Location: dhav.c:286

Technical Details

ASAN: "READ of size 4 at 0x714313098810 ... 16 bytes after 1048576-byte region". get_duration() allocates a fixed 1 MiB buffer via av_malloc and later dereferences a 4-byte word at an index computed from file data without verifying it stays within the buffer, resulting in a heap OOB read just past the allocation.

Crash trace (truncated — full trace in attached crash.log):

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1615271022
INFO: Loaded 1 modules   (117549 inline 8-bit counters): 117549 [0x605c5bb75fc8, 0x605c5bb92af5), 
INFO: Loaded 1 PC tables (117549 PCs): 117549 [0x605c5bb92af8,0x605c5bd5ddc8), 
/out/ffmpeg_dem_DHAV_fuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1


=== ASAN Report ===
=================================================================
==27==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x714313098810 at pc 0x605c5b1d027f bp 0x7ffe7dca1550 sp 0x7ffe7dca1548
READ of size 4 at 0x714313098810 thread T0
    #0 0x605c5b1d027e in get_duration /src/ffmpeg/libavformat/dhav.c:286:12
    #1 0x605c5b1d027e in dhav_read_header /src/ffmpeg/libavformat/dhav.c:332:22
    #2 0x605c5b1ae54c in avformat_open_input /src/ffmpeg/libavformat/demux.c:323:20
    #3 0x605c5b121917 in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_dem_fuzzer.c:199:11
    #4 0x605c5afbea7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #5 0x605c5afa97f2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    #6 0x605c5afaf6c0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
    #7 0x605c5afdb1f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    [... 13 more frames — full trace in crash.log]

Reproduction

  1. Craft a DHAV file whose trailer/size fields cause get_duration() to compute an index beyond the 1 MiB scan buffer
  2. Deliver the file to the target (upload, attachment, stream)
  3. Target calls avformat_open_input(), which invokes dhav_read_header() -> get_duration()
  4. 4-byte read occurs 16 bytes past the heap allocation

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-4YJK1P9J.

Reference: ANT-2026-4YJK1P9J
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict
true positive
Severity
high
UPSTREAM FIX

The change that resolved this finding.

diff --git a/libavformat/dhav.c b/libavformat/dhav.c
index 598780e8b86f1..82e2783461586 100644
--- a/libavformat/dhav.c
+++ b/libavformat/dhav.c
@@ -280,7 +280,7 @@ static int64_t get_duration(AVFormatContext *s)
         }
     }
 
-    if (pos < buffer_pos || pos + 20 > buffer_pos + buffer_size)
+    if (pos < buffer_pos || pos - buffer_pos > buffer_size - 20)
         goto fail;
 
     date = AV_RL32(buffer + (pos - buffer_pos) + 16);

https://github.com/FFmpeg/FFmpeg/commit/50e65074f5cca638d6dd4cf9db4b6dcf4f0a863e

TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-24 Reported to tracker
  2. 2026-05-28 Sent to maintainer
  3. 2026-06-05 Maintainer acknowledged
  4. 2026-06-11 Patch released
  5. 2026-08-17 Publicly revealed
PROVENANCE

SHA-3-512 hash:

338a843160c0a0f5b9211ab7c755878905005b8f97e1eed8b5fa671e4b27519e850b2dfd7e2f409de7cf6f65d018a272578d0b7029093170b31c278e30a01595

Committed 2026-05-28 07:58 PT

Revealed 2026-08-17 16:05 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-4YJK1P9J",
  "bug_class": "Heap-buffer-overflow",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-24T18:34:21+00:00",
  "description": "While opening a DHAV container, dhav_read_header() calls get_duration(), which allocates a 1 MiB scan buffer (dhav.c:264) and then reads a 4-byte value at an offset that lands 16 bytes past the end of that buffer (dhav.c:286). The offset appears to be derived from attacker-controlled file contents and is not bounds-checked against the allocated buffer size. An attacker who can supply a DHAV file to any FFmpeg-based pipeline can trigger this out-of-bounds read, leading to a crash or potential disclosure of adjacent heap memory.",
  "discovered_at": null,
  "location": "dhav.c:286",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "ffmpeg",
  "reproduction": [
    "1. Craft a DHAV file whose trailer/size fields cause get_duration() to compute an index beyond the 1 MiB scan buffer",
    "2. Deliver the file to the target (upload, attachment, stream)",
    "3. Target calls avformat_open_input(), which invokes dhav_read_header() -> get_duration()",
    "4. 4-byte read occurs 16 bytes past the heap allocation"
  ],
  "technical_details": "ASAN: \"READ of size 4 at 0x714313098810 ... 16 bytes after 1048576-byte region\". get_duration() allocates a fixed 1 MiB buffer via av_malloc and later dereferences a 4-byte word at an index computed from file data without verifying it stays within the buffer, resulting in a heap OOB read just past the allocation.",
  "title": "Heap-buffer-overflow in dhav.c:286",
  "vendor_severity": "high"
}